/etc/audit /etc/audit/audit-stop.rules /etc/audit/audit.rules /etc/audit/auditd.conf /etc/audit/plugins.d /etc/audit/plugins.d/af_unix.conf /etc/audit/rules.d /etc/audit/rules.d/audit.rules /usr/bin/auditctl /usr/bin/auditd /usr/bin/augenrules /usr/bin/aulast /usr/bin/aulastlog /usr/bin/aureport /usr/bin/ausearch /usr/bin/ausyscall /usr/bin/autrace /usr/bin/auvirt /usr/lib/systemd/system-preset/86-audit.preset /usr/share/audit /usr/share/audit/sample-rules /usr/share/audit/sample-rules/10-base-config.rules /usr/share/audit/sample-rules/10-no-audit.rules /usr/share/audit/sample-rules/11-loginuid.rules /usr/share/audit/sample-rules/12-cont-fail.rules /usr/share/audit/sample-rules/12-ignore-error.rules /usr/share/audit/sample-rules/20-dont-audit.rules /usr/share/audit/sample-rules/21-no32bit.rules /usr/share/audit/sample-rules/22-ignore-chrony.rules /usr/share/audit/sample-rules/23-ignore-filesystems.rules /usr/share/audit/sample-rules/30-nispom.rules /usr/share/audit/sample-rules/30-ospp-v42-1-create-failed.rules /usr/share/audit/sample-rules/30-ospp-v42-1-create-success.rules /usr/share/audit/sample-rules/30-ospp-v42-2-modify-failed.rules /usr/share/audit/sample-rules/30-ospp-v42-2-modify-success.rules /usr/share/audit/sample-rules/30-ospp-v42-3-access-failed.rules /usr/share/audit/sample-rules/30-ospp-v42-3-access-success.rules /usr/share/audit/sample-rules/30-ospp-v42-4-delete-failed.rules /usr/share/audit/sample-rules/30-ospp-v42-4-delete-success.rules /usr/share/audit/sample-rules/30-ospp-v42-5-perm-change-failed.rules /usr/share/audit/sample-rules/30-ospp-v42-5-perm-change-success.rules /usr/share/audit/sample-rules/30-ospp-v42-6-owner-change-failed.rules /usr/share/audit/sample-rules/30-ospp-v42-6-owner-change-success.rules /usr/share/audit/sample-rules/30-ospp-v42.rules /usr/share/audit/sample-rules/30-pci-dss-v31.rules /usr/share/audit/sample-rules/30-stig.rules /usr/share/audit/sample-rules/31-privileged.rules /usr/share/audit/sample-rules/32-power-abuse.rules /usr/share/audit/sample-rules/40-local.rules /usr/share/audit/sample-rules/41-containers.rules /usr/share/audit/sample-rules/42-injection.rules /usr/share/audit/sample-rules/43-module-load.rules /usr/share/audit/sample-rules/44-installers.rules /usr/share/audit/sample-rules/70-einval.rules /usr/share/audit/sample-rules/71-networking.rules /usr/share/audit/sample-rules/99-finalize.rules /usr/share/audit/sample-rules/README-rules /usr/share/doc/audit /usr/share/doc/audit/README /usr/share/doc/audit/auditd.cron /usr/share/doc/audit/rules /usr/share/doc/audit/rules/10-base-config.rules /usr/share/doc/audit/rules/10-no-audit.rules /usr/share/doc/audit/rules/11-loginuid.rules /usr/share/doc/audit/rules/12-cont-fail.rules /usr/share/doc/audit/rules/12-ignore-error.rules /usr/share/doc/audit/rules/20-dont-audit.rules /usr/share/doc/audit/rules/21-no32bit.rules /usr/share/doc/audit/rules/22-ignore-chrony.rules /usr/share/doc/audit/rules/23-ignore-filesystems.rules /usr/share/doc/audit/rules/30-nispom.rules /usr/share/doc/audit/rules/30-ospp-v42-1-create-failed.rules /usr/share/doc/audit/rules/30-ospp-v42-1-create-success.rules /usr/share/doc/audit/rules/30-ospp-v42-2-modify-failed.rules /usr/share/doc/audit/rules/30-ospp-v42-2-modify-success.rules /usr/share/doc/audit/rules/30-ospp-v42-3-access-failed.rules /usr/share/doc/audit/rules/30-ospp-v42-3-access-success.rules /usr/share/doc/audit/rules/30-ospp-v42-4-delete-failed.rules /usr/share/doc/audit/rules/30-ospp-v42-4-delete-success.rules /usr/share/doc/audit/rules/30-ospp-v42-5-perm-change-failed.rules /usr/share/doc/audit/rules/30-ospp-v42-5-perm-change-success.rules /usr/share/doc/audit/rules/30-ospp-v42-6-owner-change-failed.rules /usr/share/doc/audit/rules/30-ospp-v42-6-owner-change-success.rules /usr/share/doc/audit/rules/30-ospp-v42.rules /usr/share/doc/audit/rules/30-pci-dss-v31.rules /usr/share/doc/audit/rules/30-stig.rules /usr/share/doc/audit/rules/31-privileged.rules /usr/share/doc/audit/rules/32-power-abuse.rules /usr/share/doc/audit/rules/40-local.rules /usr/share/doc/audit/rules/41-containers.rules /usr/share/doc/audit/rules/42-injection.rules /usr/share/doc/audit/rules/43-module-load.rules /usr/share/doc/audit/rules/44-installers.rules /usr/share/doc/audit/rules/70-einval.rules /usr/share/doc/audit/rules/71-networking.rules /usr/share/doc/audit/rules/99-finalize.rules /usr/share/doc/audit/rules/Makefile /usr/share/doc/audit/rules/Makefile.am /usr/share/doc/audit/rules/Makefile.in /usr/share/doc/audit/rules/README-rules /usr/share/man/man5/auditd-plugins.5.zst /usr/share/man/man5/auditd.conf.5.zst /usr/share/man/man5/ausearch-expression.5.zst /usr/share/man/man7/audit.rules.7.zst /usr/share/man/man8/auditctl.8.zst /usr/share/man/man8/auditd.8.zst /usr/share/man/man8/augenrules.8.zst /usr/share/man/man8/aulast.8.zst /usr/share/man/man8/aulastlog.8.zst /usr/share/man/man8/aureport.8.zst /usr/share/man/man8/ausearch.8.zst /usr/share/man/man8/ausyscall.8.zst /usr/share/man/man8/autrace.8.zst /usr/share/man/man8/auvirt.8.zst /var/log/audit