type:EXECVE (a0:systemctl* OR a0:service*) (a1:reload* OR a1:start*)