diff -Nru audit-2.8.4.orig/init.d/auditd.conf audit-2.8.4/init.d/auditd.conf --- audit-2.8.4.orig/init.d/auditd.conf 2018-05-21 19:38:08.000000000 +0200 +++ audit-2.8.4/init.d/auditd.conf 2019-01-05 08:37:15.638139602 +0100 @@ -13,7 +13,7 @@ num_logs = 5 priority_boost = 4 disp_qos = lossy -dispatcher = /sbin/audispd +dispatcher = /usr/sbin/audispd name_format = NONE ##name = mydomain max_log_file_action = ROTATE diff -Nru audit-2.8.4.orig/init.d/auditd.cron audit-2.8.4/init.d/auditd.cron --- audit-2.8.4.orig/init.d/auditd.cron 2018-05-21 19:38:08.000000000 +0200 +++ audit-2.8.4/init.d/auditd.cron 2019-01-05 08:39:37.092758696 +0100 @@ -5,7 +5,7 @@ # based on a cron job. ########## -/sbin/service auditd rotate +/usr/sbin/service auditd rotate EXITVALUE=$? if [ $EXITVALUE != 0 ]; then /usr/bin/logger -t auditd "ALERT exited abnormally with [$EXITVALUE]" diff -Nru audit-2.8.4.orig/init.d/auditd.service audit-2.8.4/init.d/auditd.service --- audit-2.8.4.orig/init.d/auditd.service 2018-06-19 20:16:43.000000000 +0200 +++ audit-2.8.4/init.d/auditd.service 2019-01-05 08:38:06.846363989 +0100 @@ -13,16 +13,16 @@ [Service] Type=forking -PIDFile=/var/run/auditd.pid -ExecStart=/sbin/auditd +PIDFile=/run/auditd.pid +ExecStart=/usr/sbin/auditd ## To not use augenrules, copy this file to /etc/systemd/system/auditd.service ## and comment/delete the next line and uncomment the auditctl line. ## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/ -ExecStartPost=-/sbin/augenrules --load -#ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules +ExecStartPost=-/usr/sbin/augenrules --load +#ExecStartPost=-/usr/sbin/auditctl -R /etc/audit/audit.rules # By default we don't clear the rules on exit. To enable this, uncomment # the next line after copying the file to /etc/systemd/system/auditd.service -#ExecStopPost=/sbin/auditctl -R /etc/audit/audit-stop.rules +#ExecStopPost=/usr/sbin/auditctl -R /etc/audit/audit-stop.rules [Install] WantedBy=multi-user.target diff -Nru audit-2.8.4.orig/init.d/augenrules audit-2.8.4/init.d/augenrules --- audit-2.8.4.orig/init.d/augenrules 2018-05-21 19:38:08.000000000 +0200 +++ audit-2.8.4/init.d/augenrules 2019-01-05 08:39:12.764652379 +0100 @@ -39,7 +39,7 @@ try_load() { if [ $LoadRules -eq 1 ] ; then - /sbin/auditctl -R ${DestinationFile} + /usr/sbin/auditctl -R ${DestinationFile} RETVAL=$? fi }