Audit execution of the reboot command

Trying to setup auditing of the execution of the /sbin/reboot, /sbin/init, /sbin/shutdown in RHEL 8. Adding audit rules specifying these files does not work. These are hard links to systemctl and/or systemd. Are there any solutions to getting auditd to trap on the execution of a hard link?