/etc/audit/auditd.conf
/etc/audit/plugins.d
/usr/bin/aulast
/usr/bin/aulastlog
/usr/bin/ausyscall
/usr/lib/.build-id
/usr/lib/.build-id/2c
/usr/lib/.build-id/2c/d4f7407870e70fb002b0ccac89389caa4e80d5
/usr/lib/.build-id/70
/usr/lib/.build-id/70/ab4592b9509b7b5dd4153a886ef1d95ed32fd7
/usr/lib/.build-id/9d
/usr/lib/.build-id/9d/1ffa9c3b8f013a71ce7fd27065c3d1400bc834
/usr/lib/.build-id/c7
/usr/lib/.build-id/c7/6d94b8790ace8dac020dbacbb3ec6da6aac63b
/usr/lib/.build-id/f8
/usr/lib/.build-id/f8/0b0af1041f7b20bd630b0adbb013f2e03d8b6d
/usr/lib/.build-id/fa
/usr/lib/.build-id/fa/5b23e77c409c0d0a4f44d12701fc21a3415463
/usr/lib/systemd/system/auditd.service
/usr/lib/tmpfiles.d/audit.conf
/usr/libexec/initscripts/legacy-actions/auditd
/usr/libexec/initscripts/legacy-actions/auditd/condrestart
/usr/libexec/initscripts/legacy-actions/auditd/reload
/usr/libexec/initscripts/legacy-actions/auditd/restart
/usr/libexec/initscripts/legacy-actions/auditd/resume
/usr/libexec/initscripts/legacy-actions/auditd/rotate
/usr/libexec/initscripts/legacy-actions/auditd/state
/usr/libexec/initscripts/legacy-actions/auditd/stop
/usr/sbin/auditd
/usr/sbin/aureport
/usr/sbin/ausearch
/usr/share/doc/audit
/usr/share/doc/audit/ChangeLog
/usr/share/doc/audit/README.md
/usr/share/doc/audit/auditd.cron
/usr/share/licenses/audit
/usr/share/licenses/audit/COPYING
/usr/share/man/man5/auditd-plugins.5.gz
/usr/share/man/man5/auditd.conf.5.gz
/usr/share/man/man5/auditd.cron.5.gz
/usr/share/man/man8/auditd.8.gz
/usr/share/man/man8/aulast.8.gz
/usr/share/man/man8/aulastlog.8.gz
/usr/share/man/man8/aureport.8.gz
/usr/share/man/man8/ausearch.8.gz
/usr/share/man/man8/ausyscall.8.gz
/var/log/audit
/var/run/auditd.state