/etc/audit/auditd.conf
/etc/audit/plugins.d
/usr/bin/aulast
/usr/bin/aulastlog
/usr/bin/ausyscall
/usr/lib/.build-id
/usr/lib/.build-id/2a
/usr/lib/.build-id/2a/fdd248b8d4c423626536fd0796fb10ab2de74c
/usr/lib/.build-id/2e
/usr/lib/.build-id/2e/9ea624b80f5076654a3b9b35b4432ead2426cf
/usr/lib/.build-id/30
/usr/lib/.build-id/30/671ab8108b83ecf198515fe88bb289672ae6cb
/usr/lib/.build-id/63
/usr/lib/.build-id/63/eb40f8438e8446ed6c3ab4ab74a55a63e6fb9f
/usr/lib/.build-id/68
/usr/lib/.build-id/68/8344f761a5d9327aa59b50382a4574102dc24d
/usr/lib/.build-id/ac
/usr/lib/.build-id/ac/43ef38749015fe2dfa3fd8078de56d34e0958a
/usr/lib/systemd/system/auditd.service
/usr/libexec/initscripts/legacy-actions/auditd
/usr/libexec/initscripts/legacy-actions/auditd/condrestart
/usr/libexec/initscripts/legacy-actions/auditd/reload
/usr/libexec/initscripts/legacy-actions/auditd/restart
/usr/libexec/initscripts/legacy-actions/auditd/resume
/usr/libexec/initscripts/legacy-actions/auditd/rotate
/usr/libexec/initscripts/legacy-actions/auditd/state
/usr/libexec/initscripts/legacy-actions/auditd/stop
/usr/sbin/auditd
/usr/sbin/aureport
/usr/sbin/ausearch
/usr/share/doc/audit
/usr/share/doc/audit/ChangeLog
/usr/share/doc/audit/README.md
/usr/share/doc/audit/auditd.cron
/usr/share/licenses/audit
/usr/share/licenses/audit/COPYING
/usr/share/man/man5/auditd-plugins.5.gz
/usr/share/man/man5/auditd.conf.5.gz
/usr/share/man/man8/auditd.8.gz
/usr/share/man/man8/aulast.8.gz
/usr/share/man/man8/aulastlog.8.gz
/usr/share/man/man8/aureport.8.gz
/usr/share/man/man8/ausearch.8.gz
/usr/share/man/man8/ausyscall.8.gz
/var/log/audit
/var/run/auditd.state