diff --git a/tasks/koji/base_builder.yml b/tasks/koji/base_builder.yml
index 85ea089454..dd649a2614 100644
--- a/tasks/koji/base_builder.yml
+++ b/tasks/koji/base_builder.yml
@@ -40,7 +40,6 @@
 - name: clean up packages we do not need
   action: yum state=removed pkg={{ item }}
   with_items:
-    - audit
     - 'cronie\*'
 
 - name: add pkgs
@@ -54,6 +53,8 @@
     - kernel-firmware
     - ntp
     - ntpdate
+    - rsyslog
+    - audit
 
 - name: /etc/kojid/kojid.conf
   action: copy src="{{ files }}/kojibuilder/kojid.conf" dest=/etc/kojid/kojid.conf
@@ -61,7 +62,6 @@
   notify:
   - restart kojid
 
-
 - name: arm /etc/kojid/kojid.conf
   action: copy src="{{ files }}/kojibuilder/arm-kojid.conf" dest=/etc/kojid/kojid.conf
   when: inventory_hostname.startswith(('arm01','arm03'))
diff --git a/vars/Fedora.yml b/vars/Fedora.yml
index 42f54a6837..14ebc4cab1 100644
--- a/vars/Fedora.yml
+++ b/vars/Fedora.yml
@@ -3,4 +3,4 @@ dist_tag: f{{ ansible_distribution_version }}
 base_pkgs_inst: ['iptables-services' ]
 base_pkgs_erase: ['firewalld', 'PackageKit*', 'sendmail', 'at']
 service_disabled: [ ]
-service_enabled: [ ]
+service_enabled: ['iptables','audit']