/etc/audit/auditd.conf
/etc/audit/plugins.d
/usr/bin/aulast
/usr/bin/aulastlog
/usr/bin/ausyscall
/usr/lib/.build-id
/usr/lib/.build-id/09
/usr/lib/.build-id/09/0123e71ca4ba9dae6f0523ac5359fd963cb969
/usr/lib/.build-id/44
/usr/lib/.build-id/44/a0fe18dc46e673f3428b6d680d94391fceeff3
/usr/lib/.build-id/54
/usr/lib/.build-id/54/c88628fe175f89c6c7c2c99e95f7d9c916c129
/usr/lib/.build-id/5a
/usr/lib/.build-id/5a/d7bb254c9679f460f7b8c589907cd95f1f38c5
/usr/lib/.build-id/6f
/usr/lib/.build-id/6f/d613da5bd0aaa2966bf98c6b4137ff207db51e
/usr/lib/.build-id/ba
/usr/lib/.build-id/ba/b93cdb02cd9cc7e248e3ddee06f9e16ed514ad
/usr/lib/systemd/system/auditd.service
/usr/lib/tmpfiles.d/audit.conf
/usr/libexec/initscripts/legacy-actions/auditd
/usr/libexec/initscripts/legacy-actions/auditd/condrestart
/usr/libexec/initscripts/legacy-actions/auditd/reload
/usr/libexec/initscripts/legacy-actions/auditd/restart
/usr/libexec/initscripts/legacy-actions/auditd/resume
/usr/libexec/initscripts/legacy-actions/auditd/rotate
/usr/libexec/initscripts/legacy-actions/auditd/state
/usr/libexec/initscripts/legacy-actions/auditd/stop
/usr/sbin/auditd
/usr/sbin/aureport
/usr/sbin/ausearch
/usr/share/doc/audit
/usr/share/doc/audit/ChangeLog
/usr/share/doc/audit/README.md
/usr/share/doc/audit/auditd.cron
/usr/share/licenses/audit
/usr/share/licenses/audit/COPYING
/usr/share/man/man5/auditd-plugins.5.gz
/usr/share/man/man5/auditd.conf.5.gz
/usr/share/man/man5/auditd.cron.5.gz
/usr/share/man/man8/auditd.8.gz
/usr/share/man/man8/aulast.8.gz
/usr/share/man/man8/aulastlog.8.gz
/usr/share/man/man8/aureport.8.gz
/usr/share/man/man8/ausearch.8.gz
/usr/share/man/man8/ausyscall.8.gz
/var/log/audit
/var/run/auditd.state