/etc/audit/auditd.conf
/etc/audit/plugins.d
/usr/bin/aulast
/usr/bin/aulastlog
/usr/bin/ausyscall
/usr/lib/.build-id
/usr/lib/.build-id/21
/usr/lib/.build-id/21/a7f6b6d578a45538249f5d96eafa35cb04503e
/usr/lib/.build-id/5c
/usr/lib/.build-id/5c/f33ccafee4e1b6e5373768e4cfdc81ec226ed8
/usr/lib/.build-id/8d
/usr/lib/.build-id/8d/fb7df4598cc7e57037f7d823e83b8ad060cc9c
/usr/lib/.build-id/9d
/usr/lib/.build-id/9d/d3e2edcd91ebe527805af5072d16f5f84b06f4
/usr/lib/.build-id/a5
/usr/lib/.build-id/a5/9c0dd424d3e6aee4fd74512357dec9051caae0
/usr/lib/.build-id/be
/usr/lib/.build-id/be/ec68c61456d0525632d30d4b0d809f90666bd0
/usr/lib/systemd/system/auditd.service
/usr/libexec/initscripts/legacy-actions/auditd
/usr/libexec/initscripts/legacy-actions/auditd/condrestart
/usr/libexec/initscripts/legacy-actions/auditd/reload
/usr/libexec/initscripts/legacy-actions/auditd/restart
/usr/libexec/initscripts/legacy-actions/auditd/resume
/usr/libexec/initscripts/legacy-actions/auditd/rotate
/usr/libexec/initscripts/legacy-actions/auditd/state
/usr/libexec/initscripts/legacy-actions/auditd/stop
/usr/sbin/auditd
/usr/sbin/aureport
/usr/sbin/ausearch
/usr/share/doc/audit
/usr/share/doc/audit/ChangeLog
/usr/share/doc/audit/README.md
/usr/share/doc/audit/auditd.cron
/usr/share/licenses/audit
/usr/share/licenses/audit/COPYING
/usr/share/man/man5/auditd-plugins.5.gz
/usr/share/man/man5/auditd.conf.5.gz
/usr/share/man/man8/auditd.8.gz
/usr/share/man/man8/aulast.8.gz
/usr/share/man/man8/aulastlog.8.gz
/usr/share/man/man8/aureport.8.gz
/usr/share/man/man8/ausearch.8.gz
/usr/share/man/man8/ausyscall.8.gz
/var/log/audit
/var/run/auditd.state