chrisbinnie ~ # cd /etc/audit/
chrisbinnie audit # ls
auditd.conf  audit.rules  rules.d
chrisbinnie audit # ls -al
total 20
drwxr-x---  3 root root 4096 Dec 16 12:34 .
drwxr-xr-x 95 root root 4096 Dec 16 12:34 ..
-rw-r-----  1 root root  701 Dec  9  2014 auditd.conf
-rw-r-----  1 root root  373 Dec  9  2014 audit.rules
drwxr-x---  2 root root 4096 Dec 16 12:34 rules.d
chrisbinnie audit # ls -al rules.d/
total 12
drwxr-x--- 2 root root 4096 Dec 16 12:34 .
drwxr-x--- 3 root root 4096 Dec 16 12:34 ..
-rw-r----- 1 root root  373 Dec  9  2014 audit.rules