/etc/audit/auditd.conf
/etc/audit/plugins.d
/usr/bin/aulast
/usr/bin/aulastlog
/usr/bin/ausyscall
/usr/lib/.build-id
/usr/lib/.build-id/21
/usr/lib/.build-id/21/ce749e4e0b52d8b040409efc358105c3a85497
/usr/lib/.build-id/23
/usr/lib/.build-id/23/6b05eadda699c1bea22b9ed5fb96a297394c28
/usr/lib/.build-id/71
/usr/lib/.build-id/71/3a15d9e9e17c761f9e97a3978bd17207c26225
/usr/lib/.build-id/75
/usr/lib/.build-id/75/b9d069150d6ac86dc42139c593a648063eafbb
/usr/lib/.build-id/bb
/usr/lib/.build-id/bb/ea28aa8930fa3959aebbad20c7d4119e32f570
/usr/lib/.build-id/fa
/usr/lib/.build-id/fa/992a1fc245831a9e40ef1acc6f0b08c1c260c5
/usr/lib/systemd/system/auditd.service
/usr/lib/tmpfiles.d/audit.conf
/usr/libexec/initscripts/legacy-actions/auditd
/usr/libexec/initscripts/legacy-actions/auditd/condrestart
/usr/libexec/initscripts/legacy-actions/auditd/reload
/usr/libexec/initscripts/legacy-actions/auditd/restart
/usr/libexec/initscripts/legacy-actions/auditd/resume
/usr/libexec/initscripts/legacy-actions/auditd/rotate
/usr/libexec/initscripts/legacy-actions/auditd/state
/usr/libexec/initscripts/legacy-actions/auditd/stop
/usr/sbin/auditd
/usr/sbin/aureport
/usr/sbin/ausearch
/usr/share/doc/audit
/usr/share/doc/audit/ChangeLog
/usr/share/doc/audit/README.md
/usr/share/doc/audit/auditd.cron
/usr/share/licenses/audit
/usr/share/licenses/audit/COPYING
/usr/share/man/man5/auditd-plugins.5.gz
/usr/share/man/man5/auditd.conf.5.gz
/usr/share/man/man8/auditd.8.gz
/usr/share/man/man8/aulast.8.gz
/usr/share/man/man8/aulastlog.8.gz
/usr/share/man/man8/aureport.8.gz
/usr/share/man/man8/ausearch.8.gz
/usr/share/man/man8/ausyscall.8.gz
/var/log/audit
/var/run/auditd.state