/etc/audit
/etc/audit/audit-stop.rules
/etc/audit/audit.rules
/etc/audit/rules.d
/etc/audit/rules.d/audit.rules
/usr/lib/.build-id
/usr/lib/.build-id/02
/usr/lib/.build-id/02/3d5dbcfc417e690d0f7d6c88f6f62ee668ddc2
/usr/lib/systemd/system/audit-rules.service
/usr/sbin/auditctl
/usr/sbin/augenrules
/usr/share/audit-rules
/usr/share/audit-rules/10-base-config.rules
/usr/share/audit-rules/10-no-audit.rules
/usr/share/audit-rules/11-loginuid.rules
/usr/share/audit-rules/12-cont-fail.rules
/usr/share/audit-rules/12-ignore-error.rules
/usr/share/audit-rules/20-dont-audit.rules
/usr/share/audit-rules/21-no32bit.rules
/usr/share/audit-rules/22-ignore-chrony.rules
/usr/share/audit-rules/23-ignore-filesystems.rules
/usr/share/audit-rules/30-ospp-v42-1-create-failed.rules
/usr/share/audit-rules/30-ospp-v42-1-create-success.rules
/usr/share/audit-rules/30-ospp-v42-2-modify-failed.rules
/usr/share/audit-rules/30-ospp-v42-2-modify-success.rules
/usr/share/audit-rules/30-ospp-v42-3-access-failed.rules
/usr/share/audit-rules/30-ospp-v42-3-access-success.rules
/usr/share/audit-rules/30-ospp-v42-4-delete-failed.rules
/usr/share/audit-rules/30-ospp-v42-4-delete-success.rules
/usr/share/audit-rules/30-ospp-v42-5-perm-change-failed.rules
/usr/share/audit-rules/30-ospp-v42-5-perm-change-success.rules
/usr/share/audit-rules/30-ospp-v42-6-owner-change-failed.rules
/usr/share/audit-rules/30-ospp-v42-6-owner-change-success.rules
/usr/share/audit-rules/30-ospp-v42.rules
/usr/share/audit-rules/30-pci-dss-v31.rules
/usr/share/audit-rules/30-stig.rules
/usr/share/audit-rules/31-privileged.rules
/usr/share/audit-rules/32-power-abuse.rules
/usr/share/audit-rules/40-local.rules
/usr/share/audit-rules/41-containers.rules
/usr/share/audit-rules/42-injection.rules
/usr/share/audit-rules/43-module-load.rules
/usr/share/audit-rules/44-installers.rules
/usr/share/audit-rules/70-einval.rules
/usr/share/audit-rules/71-networking.rules
/usr/share/audit-rules/99-finalize.rules
/usr/share/audit-rules/README-rules
/usr/share/man/man7/audit.rules.7.gz
/usr/share/man/man8/auditctl.8.gz
/usr/share/man/man8/augenrules.8.gz