diff -ru audit-2.8.5.orig/init.d/auditd.conf audit-2.8.5/init.d/auditd.conf --- audit-2.8.5.orig/init.d/auditd.conf 2019-03-01 21:19:13.000000000 +0100 +++ audit-2.8.5/init.d/auditd.conf 2019-05-27 10:02:17.350769165 +0200 @@ -13,7 +13,7 @@ num_logs = 5 priority_boost = 4 disp_qos = lossy -dispatcher = /sbin/audispd +dispatcher = /usr/sbin/audispd name_format = NONE ##name = mydomain max_log_file_action = ROTATE diff -ru audit-2.8.5.orig/init.d/auditd.cron audit-2.8.5/init.d/auditd.cron --- audit-2.8.5.orig/init.d/auditd.cron 2019-02-04 15:26:52.000000000 +0100 +++ audit-2.8.5/init.d/auditd.cron 2019-05-27 10:02:17.350769165 +0200 @@ -5,7 +5,7 @@ # based on a cron job. ########## -/sbin/service auditd rotate +/usr/sbin/service auditd rotate EXITVALUE=$? if [ $EXITVALUE != 0 ]; then /usr/bin/logger -t auditd "ALERT exited abnormally with [$EXITVALUE]" diff -ru audit-2.8.5.orig/init.d/auditd.service audit-2.8.5/init.d/auditd.service --- audit-2.8.5.orig/init.d/auditd.service 2019-03-01 21:19:13.000000000 +0100 +++ audit-2.8.5/init.d/auditd.service 2019-05-27 10:02:56.066935836 +0200 @@ -18,15 +18,15 @@ [Service] Type=forking PIDFile=/run/auditd.pid -ExecStart=/sbin/auditd +ExecStart=/usr/sbin/auditd ## To not use augenrules, copy this file to /etc/systemd/system/auditd.service ## and comment/delete the next line and uncomment the auditctl line. ## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/ -ExecStartPost=-/sbin/augenrules --load -#ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules +ExecStartPost=-/usr/sbin/augenrules --load +#ExecStartPost=-/usr/sbin/auditctl -R /etc/audit/audit.rules # By default we don't clear the rules on exit. To enable this, uncomment # the next line after copying the file to /etc/systemd/system/auditd.service -#ExecStopPost=/sbin/auditctl -R /etc/audit/audit-stop.rules +#ExecStopPost=/usr/sbin/auditctl -R /etc/audit/audit-stop.rules [Install] WantedBy=multi-user.target diff -ru audit-2.8.5.orig/init.d/augenrules audit-2.8.5/init.d/augenrules --- audit-2.8.5.orig/init.d/augenrules 2019-02-04 15:26:52.000000000 +0100 +++ audit-2.8.5/init.d/augenrules 2019-05-27 10:02:17.354769182 +0200 @@ -39,7 +39,7 @@ try_load() { if [ $LoadRules -eq 1 ] ; then - /sbin/auditctl -R ${DestinationFile} + /usr/sbin/auditctl -R ${DestinationFile} RETVAL=$? fi }