/etc/audit/auditd.conf
/etc/audit/plugins.d
/usr/bin/aulast
/usr/bin/aulastlog
/usr/bin/ausyscall
/usr/lib/.build-id
/usr/lib/.build-id/10
/usr/lib/.build-id/10/7eb1b4102c3c593b60f76ad7263e9921c56766
/usr/lib/.build-id/2c
/usr/lib/.build-id/2c/c8886756667e72d0c9bdf8a36f11e2bd86c4b1
/usr/lib/.build-id/62
/usr/lib/.build-id/62/ad269e6206a53987beb0cb1e16a82b51034b19
/usr/lib/.build-id/b7
/usr/lib/.build-id/b7/5bc7dcea4b1efba8660052218dc5e2595a07e0
/usr/lib/.build-id/bc
/usr/lib/.build-id/bc/cf3f13e7516c025346fa0c3680321cb42b8615
/usr/lib/.build-id/fb
/usr/lib/.build-id/fb/1131e3dba3c4182ed8107c66e2e00d309927fc
/usr/lib/systemd/system/auditd.service
/usr/lib/tmpfiles.d/audit.conf
/usr/libexec/initscripts/legacy-actions/auditd
/usr/libexec/initscripts/legacy-actions/auditd/condrestart
/usr/libexec/initscripts/legacy-actions/auditd/reload
/usr/libexec/initscripts/legacy-actions/auditd/restart
/usr/libexec/initscripts/legacy-actions/auditd/resume
/usr/libexec/initscripts/legacy-actions/auditd/rotate
/usr/libexec/initscripts/legacy-actions/auditd/state
/usr/libexec/initscripts/legacy-actions/auditd/stop
/usr/sbin/auditd
/usr/sbin/aureport
/usr/sbin/ausearch
/usr/share/doc/audit
/usr/share/doc/audit/ChangeLog
/usr/share/doc/audit/README.md
/usr/share/doc/audit/auditd.cron
/usr/share/licenses/audit
/usr/share/licenses/audit/COPYING
/usr/share/man/man5/auditd-plugins.5.gz
/usr/share/man/man5/auditd.conf.5.gz
/usr/share/man/man8/auditd.8.gz
/usr/share/man/man8/aulast.8.gz
/usr/share/man/man8/aulastlog.8.gz
/usr/share/man/man8/aureport.8.gz
/usr/share/man/man8/ausearch.8.gz
/usr/share/man/man8/ausyscall.8.gz
/var/log/audit
/var/run/auditd.state