Use osquery to check audit logging policy