diff --git a/classes/cluster/virtual-offline-pike-ovs-dpdk/init.yml b/classes/cluster/virtual-offline-pike-ovs-dpdk/init.yml
index ebf843d..45efcbd 100644
--- a/classes/cluster/virtual-offline-pike-ovs-dpdk/init.yml
+++ b/classes/cluster/virtual-offline-pike-ovs-dpdk/init.yml
@@ -15,6 +15,7 @@
 - system.openssh.server.team.lab
 - system.openssh.server.team.tcpcloud
 - system.openssh.server.team.mcp_qa
+- system.auditd.server.ciscat
 - cluster.virtual-offline-pike-ovs-dpdk.infra
 - cluster.virtual-offline-pike-ovs-dpdk.openstack
 - cluster.virtual-offline-pike-ovs-dpdk.stacklight
diff --git a/classes/cluster/virtual-offline-pike-ovs/init.yml b/classes/cluster/virtual-offline-pike-ovs/init.yml
index 7b41e0b..8c5b321 100644
--- a/classes/cluster/virtual-offline-pike-ovs/init.yml
+++ b/classes/cluster/virtual-offline-pike-ovs/init.yml
@@ -15,6 +15,7 @@
 - system.openssh.server.team.lab
 - system.openssh.server.team.tcpcloud
 - system.openssh.server.team.mcp_qa
+- system.auditd.server.ciscat
 - cluster.virtual-offline-pike-ovs.infra
 - cluster.virtual-offline-pike-ovs.openstack
 - cluster.virtual-offline-pike-ovs.stacklight
diff --git a/classes/cluster/virtual-offline-ssl/.env b/classes/cluster/virtual-offline-ssl/.env
index b054cf5..cf4c91c 100644
--- a/classes/cluster/virtual-offline-ssl/.env
+++ b/classes/cluster/virtual-offline-ssl/.env
@@ -1 +1 @@
-FORMULAS_SALT_MASTER+=(java openssh ntp nginx collectd sensu heka sphinx mysql galera grafana libvirt rsyslog glusterfs postfix xtrabackup freeipa prometheus telegraf elasticsearch kibana rundeck devops-portal libvirt rsyslog memcached rabbitmq apache keystone glance nova neutron cinder heat horizon ironic tftpd-hpa bind powerdns designate barbican iptables fluentd dogtag barbican logrotate)
+FORMULAS_SALT_MASTER+=(java openssh ntp nginx collectd sensu heka sphinx mysql galera grafana libvirt rsyslog glusterfs postfix xtrabackup freeipa prometheus telegraf elasticsearch kibana rundeck devops-portal libvirt rsyslog memcached rabbitmq apache keystone glance nova neutron cinder heat horizon ironic tftpd-hpa bind powerdns designate barbican iptables fluentd dogtag barbican logrotate auditd)
diff --git a/classes/cluster/virtual-offline-ssl/infra/config.yml b/classes/cluster/virtual-offline-ssl/infra/config.yml
index 931d137..da13d9f 100644
--- a/classes/cluster/virtual-offline-ssl/infra/config.yml
+++ b/classes/cluster/virtual-offline-ssl/infra/config.yml
@@ -4,7 +4,6 @@
 - system.linux.system.single.debian
 - system.linux.system.repo.mcp.apt_mirantis.saltstack
 - system.linux.system.repo_local.mcp.apt_mirantis.openstack
-- system.openssh.client.lab
 - system.salt.master.pkg
 - system.salt.master.api
 - system.salt.master.formula.pkg.manila
diff --git a/classes/cluster/virtual-offline-ssl/init.yml b/classes/cluster/virtual-offline-ssl/init.yml
index 791c70d..cbbe7e6 100644
--- a/classes/cluster/virtual-offline-ssl/init.yml
+++ b/classes/cluster/virtual-offline-ssl/init.yml
@@ -9,6 +9,7 @@
 - system.openssh.server.team.lab
 - system.openssh.server.team.tcpcloud
 - system.openssh.server.team.mcp_qa
+- system.auditd.server.ciscat
 - cluster.virtual-offline-ssl.infra
 - cluster.virtual-offline-ssl.openstack
 parameters: