/etc/audit/auditd.conf
/etc/audit/plugins.d
/usr/bin/aulast
/usr/bin/aulastlog
/usr/bin/ausyscall
/usr/lib/.build-id
/usr/lib/.build-id/16
/usr/lib/.build-id/16/6ef54e8f700430d58fb0572bf2b9fb9fb7f019
/usr/lib/.build-id/49
/usr/lib/.build-id/49/54b63752e9a8b56e593a91a4e8a08333c0364c
/usr/lib/.build-id/81
/usr/lib/.build-id/81/e1fede9bda33f5ff8964cd4d259392a7e99e05
/usr/lib/.build-id/9f
/usr/lib/.build-id/9f/176a94832297cf869cf052e6511c118c6f941f
/usr/lib/.build-id/bf
/usr/lib/.build-id/bf/1d332834bc4eef66c827a49b9ce731e66f43c1
/usr/lib/.build-id/d9
/usr/lib/.build-id/d9/2a788a4475c3f1531956f03a000e26b1151110
/usr/lib/systemd/system/auditd.service
/usr/lib/tmpfiles.d/audit.conf
/usr/libexec/initscripts/legacy-actions/auditd
/usr/libexec/initscripts/legacy-actions/auditd/condrestart
/usr/libexec/initscripts/legacy-actions/auditd/reload
/usr/libexec/initscripts/legacy-actions/auditd/restart
/usr/libexec/initscripts/legacy-actions/auditd/resume
/usr/libexec/initscripts/legacy-actions/auditd/rotate
/usr/libexec/initscripts/legacy-actions/auditd/state
/usr/libexec/initscripts/legacy-actions/auditd/stop
/usr/sbin/auditd
/usr/sbin/aureport
/usr/sbin/ausearch
/usr/share/doc/audit
/usr/share/doc/audit/ChangeLog
/usr/share/doc/audit/README.md
/usr/share/doc/audit/auditd.cron
/usr/share/licenses/audit
/usr/share/licenses/audit/COPYING
/usr/share/man/man5/auditd-plugins.5.gz
/usr/share/man/man5/auditd.conf.5.gz
/usr/share/man/man8/auditd.8.gz
/usr/share/man/man8/aulast.8.gz
/usr/share/man/man8/aulastlog.8.gz
/usr/share/man/man8/aureport.8.gz
/usr/share/man/man8/ausearch.8.gz
/usr/share/man/man8/ausyscall.8.gz
/var/log/audit
/var/run/auditd.state