diff --git a/app/services/realtime_audit_service.py b/app/services/realtime_audit_service.py
index 4dc4f6c..7c48f6a 100644
--- a/app/services/realtime_audit_service.py
+++ b/app/services/realtime_audit_service.py
@@ -979,8 +979,20 @@ def audit_qualys_agent_only(hostname):
 
         result["check_connectivity"] = "Connectivité OK" in s_conn
         result["check_disk"] = " 100%" not in s_disk
-        result["check_service"] = "active (running)" in s_status or \
-                                   ("running" in s_status and "active" in s_status)
+        # Multi-format : systemd ("active (running)"), SysV anglais ("is running" / "(pid"),
+        # SysV français RHEL 5/6 ("en cours d'exécution")
+        is_running = (
+            "active (running)" in s_status
+            or "(pid " in s_status
+            or "is running" in s_status
+            or "en cours d'exécution" in s_status
+            or "en cours d'execution" in s_status  # sans accent
+        )
+        is_stopped = any(k in s_status for k in [
+            "inactive (dead)", "stopped", "not running",
+            "n'est pas en cours", "is not running"
+        ])
+        result["check_service"] = is_running and not is_stopped
         result["check_installed"] = bool(re.search(r"qualys-cloud-agent[-\s]\d", s_ver))
 
         # Ligne saturee si disque KO