diff --git a/testcases/SOP/02-auditd-sysadm.sh b/testcases/SOP/02-auditd-sysadm.sh
new file mode 100755
index 0000000000000000000000000000000000000000..197152991f7d7a7f99c0d6682fcc03303e7caa61
--- /dev/null
+++ b/testcases/SOP/02-auditd-sysadm.sh
@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+
+# ----------------------------------------------------------------------
+# Filename	:  02-auditd-sysadm.sh
+# Version	:  1.0
+# Date		:  2020/05/28
+# Author	:  Lz
+# Email		:  lz843723683@gmail.com
+# History	:     
+#                  Version 1.0, 2020/05/28
+# Function	： 测试三权分立-进行审计服务管理
+# Out		:        
+#              0 => TPASS
+#              1 => TFAIL
+#              other=> TCONF
+# ----------------------------------------------------------------------
+
+# 测试主题
+Title_Env_LTFLIB="三权分立(sysadm) - 进行审计服务管理"
+
+HeadFile_Source_LTFLIB="${LIB_SSHAUTO}"
+
+
+## TODO : 个性化,初始化
+#   Out : 0=>TPASS
+#         1=>TFAIL
+#         2=>TCONF
+TestInit_LTFLIB(){
+	return ${TPASS}
+}
+
+
+## TODO : 清理函数
+#   Out : 0=>TPASS
+#         1=>TFAIL
+#         2=>TCONF
+TestClean_LTFLIB(){
+	return ${TPASS}
+}
+
+
+## TODO : 测试用例
+testcase_1(){
+	SshAuto_CmdLocalSys_LTFLIB "sudo systemctl status auditd" "no" "no"
+	TestRetParse_LTFLIB "可以查看auditd服务" "False"
+
+	SshAuto_CmdLocalSys_LTFLIB "sudo systemctl stop auditd" "no" "yes"
+	TestRetParse_LTFLIB "不可停止auditd服务" "False"
+}
+
+## TODO : 测试用例集
+#   Out : 0=>TPASS
+#         1=>TFAIL
+#         2=>TCONF
+Testsuite_LTFLIB(){
+	testcase_1
+
+	return $TPASS
+}
+
+
+#----------------------------------------------#
+
+source "${LIB_LTFLIB}"
+Main_LTFLIB $@