auditd creates a pidfile so we should use it for status checks.
This also seems to speed up the frequent onestatus checks used in
tests/sys/audit.