chrisbinnie ~ # cd /etc/audit/ chrisbinnie audit # ls auditd.conf audit.rules rules.d chrisbinnie audit # ls -al total 20 drwxr-x--- 3 root root 4096 Dec 16 12:34 . drwxr-xr-x 95 root root 4096 Dec 16 12:34 .. -rw-r----- 1 root root 701 Dec 9 2014 auditd.conf -rw-r----- 1 root root 373 Dec 9 2014 audit.rules drwxr-x--- 2 root root 4096 Dec 16 12:34 rules.d chrisbinnie audit # ls -al rules.d/ total 12 drwxr-x--- 2 root root 4096 Dec 16 12:34 . drwxr-x--- 3 root root 4096 Dec 16 12:34 .. -rw-r----- 1 root root 373 Dec 9 2014 audit.rules