/etc/audit/auditd.conf
/etc/audit/plugins.d
/usr/bin/aulast
/usr/bin/aulastlog
/usr/bin/ausyscall
/usr/lib/.build-id
/usr/lib/.build-id/68
/usr/lib/.build-id/68/4bb40c0662e894bd964d5f0e7f2f124ff051aa
/usr/lib/.build-id/6c
/usr/lib/.build-id/6c/2df63266b383e7425a3ffb635b1785b51203ae
/usr/lib/.build-id/7f
/usr/lib/.build-id/7f/98ec6725edf0e69e8a9f90dbc9b6a0e73ca711
/usr/lib/.build-id/80
/usr/lib/.build-id/80/d22e719cbdbd58b835f43a2cb20de51354e27e
/usr/lib/.build-id/89
/usr/lib/.build-id/89/2c67f2cdec9027444ab8e812e978be5107d74a
/usr/lib/.build-id/e0
/usr/lib/.build-id/e0/2432baceb7e330b3d9541a8282de42490e42aa
/usr/lib/systemd/system/auditd.service
/usr/lib/tmpfiles.d/audit.conf
/usr/libexec/initscripts/legacy-actions/auditd
/usr/libexec/initscripts/legacy-actions/auditd/condrestart
/usr/libexec/initscripts/legacy-actions/auditd/reload
/usr/libexec/initscripts/legacy-actions/auditd/restart
/usr/libexec/initscripts/legacy-actions/auditd/resume
/usr/libexec/initscripts/legacy-actions/auditd/rotate
/usr/libexec/initscripts/legacy-actions/auditd/state
/usr/libexec/initscripts/legacy-actions/auditd/stop
/usr/sbin/auditd
/usr/sbin/aureport
/usr/sbin/ausearch
/usr/share/doc/audit
/usr/share/doc/audit/ChangeLog
/usr/share/doc/audit/README.md
/usr/share/doc/audit/auditd.cron
/usr/share/licenses/audit
/usr/share/licenses/audit/COPYING
/usr/share/man/man5/auditd-plugins.5.gz
/usr/share/man/man5/auditd.conf.5.gz
/usr/share/man/man5/auditd.cron.5.gz
/usr/share/man/man8/auditd.8.gz
/usr/share/man/man8/aulast.8.gz
/usr/share/man/man8/aulastlog.8.gz
/usr/share/man/man8/aureport.8.gz
/usr/share/man/man8/ausearch.8.gz
/usr/share/man/man8/ausyscall.8.gz
/var/log/audit
/var/run/auditd.state