/etc/audit/auditd.conf
/etc/audit/plugins.d
/usr/bin/aulast
/usr/bin/aulastlog
/usr/bin/ausyscall
/usr/lib/.build-id
/usr/lib/.build-id/05
/usr/lib/.build-id/05/b32dbe0aa7283cd4ef358630c86959d8b238fe
/usr/lib/.build-id/43
/usr/lib/.build-id/43/aa83a6d3029b6797fcbcaa884034e14cb9a283
/usr/lib/.build-id/46
/usr/lib/.build-id/46/1e0d3ed0e1121055a51c1d1271631d0f41517c
/usr/lib/.build-id/6a
/usr/lib/.build-id/6a/ae17e3bfd41020cea30d80562ca4837a571bd3
/usr/lib/.build-id/7b
/usr/lib/.build-id/7b/db0cfe5107b9fcc9e3544c400adfd91cee8492
/usr/lib/.build-id/e7
/usr/lib/.build-id/e7/d7d7977f90ff635b6afc95a072e69419b88269
/usr/lib/systemd/system/auditd.service
/usr/libexec/initscripts/legacy-actions/auditd
/usr/libexec/initscripts/legacy-actions/auditd/condrestart
/usr/libexec/initscripts/legacy-actions/auditd/reload
/usr/libexec/initscripts/legacy-actions/auditd/restart
/usr/libexec/initscripts/legacy-actions/auditd/resume
/usr/libexec/initscripts/legacy-actions/auditd/rotate
/usr/libexec/initscripts/legacy-actions/auditd/state
/usr/libexec/initscripts/legacy-actions/auditd/stop
/usr/sbin/auditd
/usr/sbin/aureport
/usr/sbin/ausearch
/usr/share/doc/audit
/usr/share/doc/audit/ChangeLog
/usr/share/doc/audit/README.md
/usr/share/doc/audit/auditd.cron
/usr/share/licenses/audit
/usr/share/licenses/audit/COPYING
/usr/share/man/man5/auditd-plugins.5.gz
/usr/share/man/man5/auditd.conf.5.gz
/usr/share/man/man8/auditd.8.gz
/usr/share/man/man8/aulast.8.gz
/usr/share/man/man8/aulastlog.8.gz
/usr/share/man/man8/aureport.8.gz
/usr/share/man/man8/ausearch.8.gz
/usr/share/man/man8/ausyscall.8.gz
/var/log/audit
/var/run/auditd.state