/etc/audit/auditd.conf
/etc/audit/plugins.d
/run/auditd.pid
/run/auditd.state
/usr/bin/aulast
/usr/bin/aulastlog
/usr/bin/ausyscall
/usr/lib/.build-id
/usr/lib/.build-id/2f
/usr/lib/.build-id/2f/842ae041eed3b57b7e73dc536d26f1b7eccf47
/usr/lib/.build-id/74
/usr/lib/.build-id/74/73a811dbe332ea4971da8de6a1b2c10aaf0d23
/usr/lib/.build-id/9f
/usr/lib/.build-id/9f/a7049127dbb324ff287eddfaa37aec42148a04
/usr/lib/.build-id/b3
/usr/lib/.build-id/b3/48f4b930071679cac06873c862badcd0a3ce62
/usr/lib/.build-id/b7
/usr/lib/.build-id/b7/1d318354e27827964ea0e52c807a1bf565a1a5
/usr/lib/.build-id/f6
/usr/lib/.build-id/f6/6c3b95c76c2b93b1f78a60d6384e4e844c5c8b
/usr/lib/systemd/system/auditd.service
/usr/lib/tmpfiles.d/audit.conf
/usr/libexec/initscripts/legacy-actions/auditd
/usr/libexec/initscripts/legacy-actions/auditd/condrestart
/usr/libexec/initscripts/legacy-actions/auditd/reload
/usr/libexec/initscripts/legacy-actions/auditd/restart
/usr/libexec/initscripts/legacy-actions/auditd/resume
/usr/libexec/initscripts/legacy-actions/auditd/rotate
/usr/libexec/initscripts/legacy-actions/auditd/state
/usr/libexec/initscripts/legacy-actions/auditd/stop
/usr/sbin/auditd
/usr/sbin/aureport
/usr/sbin/ausearch
/usr/share/bash-completion/completions/auditctl
/usr/share/bash-completion/completions/augenrules
/usr/share/bash-completion/completions/aureport
/usr/share/bash-completion/completions/ausearch
/usr/share/doc/audit
/usr/share/doc/audit/ChangeLog
/usr/share/doc/audit/README.md
/usr/share/doc/audit/auditd.cron
/usr/share/licenses/audit
/usr/share/licenses/audit/COPYING
/usr/share/man/man5/auditd-plugins.5.gz
/usr/share/man/man5/auditd.conf.5.gz
/usr/share/man/man5/auditd.cron.5.gz
/usr/share/man/man8/auditd.8.gz
/usr/share/man/man8/aulast.8.gz
/usr/share/man/man8/aulastlog.8.gz
/usr/share/man/man8/aureport.8.gz
/usr/share/man/man8/ausearch.8.gz
/usr/share/man/man8/ausyscall.8.gz
/var/log/audit