/etc/audit/auditd.conf
/etc/audit/plugins.d
/usr/bin/aulast
/usr/bin/aulastlog
/usr/bin/ausyscall
/usr/lib/.build-id
/usr/lib/.build-id/12
/usr/lib/.build-id/12/af7a5957efe4a5a82ff2016c6d97e88ada5159
/usr/lib/.build-id/2a
/usr/lib/.build-id/2a/b3ed44d1ea39fc17843262c5f965528c033fdb
/usr/lib/.build-id/99
/usr/lib/.build-id/99/3dfb3ef94e83a10f73b31e941878f67da4d19d
/usr/lib/.build-id/99/50f44485b1947b0d32d4cdc8b269edb8b29a31
/usr/lib/.build-id/a7
/usr/lib/.build-id/a7/a1af08cdf60a0b8304b84ceedf03cb09ff9267
/usr/lib/.build-id/c9
/usr/lib/.build-id/c9/fc0cd4cdc2319ae9a574db58364099832a1adb
/usr/lib/systemd/system/auditd.service
/usr/lib/tmpfiles.d/audit.conf
/usr/libexec/initscripts/legacy-actions/auditd
/usr/libexec/initscripts/legacy-actions/auditd/condrestart
/usr/libexec/initscripts/legacy-actions/auditd/reload
/usr/libexec/initscripts/legacy-actions/auditd/restart
/usr/libexec/initscripts/legacy-actions/auditd/resume
/usr/libexec/initscripts/legacy-actions/auditd/rotate
/usr/libexec/initscripts/legacy-actions/auditd/state
/usr/libexec/initscripts/legacy-actions/auditd/stop
/usr/sbin/auditd
/usr/sbin/aureport
/usr/sbin/ausearch
/usr/share/doc/audit
/usr/share/doc/audit/ChangeLog
/usr/share/doc/audit/README.md
/usr/share/doc/audit/auditd.cron
/usr/share/licenses/audit
/usr/share/licenses/audit/COPYING
/usr/share/man/man5/auditd-plugins.5.gz
/usr/share/man/man5/auditd.conf.5.gz
/usr/share/man/man8/auditd.8.gz
/usr/share/man/man8/aulast.8.gz
/usr/share/man/man8/aulastlog.8.gz
/usr/share/man/man8/aureport.8.gz
/usr/share/man/man8/ausearch.8.gz
/usr/share/man/man8/ausyscall.8.gz
/var/log/audit
/var/run/auditd.state