diff -Nru audit-2.4.4.orig/init.d/auditd.conf audit-2.4.4/init.d/auditd.conf --- audit-2.4.4.orig/init.d/auditd.conf 2015-08-13 22:56:25.000000000 +0200 +++ audit-2.4.4/init.d/auditd.conf 2015-12-01 19:54:24.403584662 +0100 @@ -10,7 +10,7 @@ freq = 20 num_logs = 5 disp_qos = lossy -dispatcher = /sbin/audispd +dispatcher = /usr/sbin/audispd name_format = NONE ##name = mydomain max_log_file = 6 --- audit-2.6.6/init.d/auditd.service.orig 2016-08-11 19:51:33.493168550 +0200 +++ audit-2.6.6/init.d/auditd.service 2016-08-12 00:43:16.758055860 +0200 @@ -9,12 +9,12 @@ Documentation=man:auditd(8) https://people.redhat.com/sgrubb/audit/ [Service] -ExecStart=/sbin/auditd -n +ExecStart=/usr/sbin/auditd -n ## To not use augenrules, copy this file to /etc/systemd/system/auditd.service ## and comment/delete the next line and uncomment the auditctl line. ## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/ -ExecStartPost=-/sbin/augenrules --load -#ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules +ExecStartPost=-/usr/sbin/augenrules --load +#ExecStartPost=-/usr/sbin/auditctl -R /etc/audit/audit.rules ExecReload=/bin/kill -HUP $MAINPID # By default we don't clear the rules on exit. To enable this, uncomment # the next line after copying the file to /etc/systemd/system/auditd.service