diff --git a/tests/tacacs/utils.py b/tests/tacacs/utils.py
index d18e631ede0..27f32534c67 100644
--- a/tests/tacacs/utils.py
+++ b/tests/tacacs/utils.py
@@ -315,7 +315,7 @@ def log_exist(ptfhost, sed_command):
 
 
 def get_auditd_config_reload_timestamp(duthost):
-    res = duthost.command("sudo service auditd status | grep 'audisp-tacplus re-initializing configuration'")
+    res = duthost.shell("sudo journalctl -u auditd --boot | grep 'audisp-tacplus re-initializing configuration'")
     logger.info("aaa config file timestamp {}".format(res["stdout_lines"]))
 
     if len(res["stdout_lines"]) == 0: