Have you tried killing the client auditd and manually restarting it (i.e. /etc/rc.d/init.d/auditd restart) ? I wonder if there's some catch-22 at system startup, relative to network startup.