Problem

When using File Integrity Monitoring (FIM) in who-data mode with the Audit provider on Fedora 43, the following log messages are produced:

2025/11/27 12:49:22 wazuh-syscheckd: ERROR: (6642): Audit health check couldn't be completed correctly.
2025/11/27 12:49:22 wazuh-syscheckd: WARNING: (6913): Who-data engine could not start. Switching who-data to real-time.

The who-data engine fails to start and reverts to real-time mode instead.

Environment

Steps to Reproduce

1. Set up Wazuh FIM in who-data mode using Audit provider on Fedora 43.

   <syscheck>
     <disabled>no</disabled>
     <frequency>43200</frequency>
     <scan_on_start>yes</scan_on_start>
     <directories whodata="yes">/root/test</directories>
   </syscheck>

2. Monitor the logs from wazuh-syscheckd.
3. Observe the error and warning messages above.