diff -ru audit-3.0.orig/init.d/auditd.cron audit-3.0/init.d/auditd.cron --- audit-3.0.orig/init.d/auditd.cron 2020-12-16 21:44:34.000000000 +0100 +++ audit-3.0/init.d/auditd.cron 2021-02-13 20:44:43.484919856 +0100 @@ -5,7 +5,7 @@ # based on a cron job. ########## -/sbin/service auditd rotate +/usr/sbin/service auditd rotate EXITVALUE=$? if [ $EXITVALUE != 0 ]; then /usr/bin/logger -t auditd "ALERT exited abnormally with [$EXITVALUE]" diff -ru audit-3.0.orig/init.d/auditd.service audit-3.0/init.d/auditd.service --- audit-3.0.orig/init.d/auditd.service 2020-12-16 21:44:34.000000000 +0100 +++ audit-3.0/init.d/auditd.service 2021-02-13 20:44:43.484919856 +0100 @@ -18,15 +18,15 @@ [Service] Type=forking PIDFile=/run/auditd.pid -ExecStart=/sbin/auditd +ExecStart=/usr/sbin/auditd ## To not use augenrules, copy this file to /etc/systemd/system/auditd.service ## and comment/delete the next line and uncomment the auditctl line. ## NOTE: augenrules expect any rules to be added to /etc/audit/rules.d/ -ExecStartPost=-/sbin/augenrules --load -#ExecStartPost=-/sbin/auditctl -R /etc/audit/audit.rules +ExecStartPost=-/usr/sbin/augenrules --load +#ExecStartPost=-/usr/sbin/auditctl -R /etc/audit/audit.rules # By default we don't clear the rules on exit. To enable this, uncomment # the next line after copying the file to /etc/systemd/system/auditd.service -#ExecStopPost=/sbin/auditctl -R /etc/audit/audit-stop.rules +#ExecStopPost=/usr/sbin/auditctl -R /etc/audit/audit-stop.rules ### Security Settings ### MemoryDenyWriteExecute=true diff -ru audit-3.0.orig/init.d/augenrules audit-3.0/init.d/augenrules --- audit-3.0.orig/init.d/augenrules 2020-12-16 21:44:34.000000000 +0100 +++ audit-3.0/init.d/augenrules 2021-02-13 20:44:43.485919874 +0100 @@ -39,7 +39,7 @@ try_load() { if [ $LoadRules -eq 1 ] ; then - /sbin/auditctl -R ${DestinationFile} + /usr/sbin/auditctl -R ${DestinationFile} RETVAL=$? fi } diff -ru audit-3.0.orig/audisp/plugins/remote/au-remote.conf audit-3.0/audisp/plugins/remote/au-remote.conf --- audit-3.0.orig/audisp/plugins/remote/au-remote.conf 2020-12-16 21:44:34.000000000 +0100 +++ audit-3.0/audisp/plugins/remote/au-remote.conf 2021-02-13 21:27:18.038655845 +0100 @@ -5,7 +5,7 @@ active = no direction = out -path = /sbin/audisp-remote +path = /usr/sbin/audisp-remote type = always #args = format = string diff -ru audit-3.0.orig/audisp/plugins/syslog/syslog.conf audit-3.0/audisp/plugins/syslog/syslog.conf --- audit-3.0.orig/audisp/plugins/syslog/syslog.conf 2020-12-16 21:44:34.000000000 +0100 +++ audit-3.0/audisp/plugins/syslog/syslog.conf 2021-02-13 21:27:06.886482221 +0100 @@ -8,7 +8,7 @@ active = no direction = out -path = /sbin/audisp-syslog +path = /usr/sbin/audisp-syslog type = always args = LOG_INFO format = string diff -ru audit-3.0.orig/audisp/plugins/zos-remote/audispd-zos-remote.conf audit-3.0/audisp/plugins/zos-remote/audispd-zos-remote.conf --- audit-3.0.orig/audisp/plugins/zos-remote/audispd-zos-remote.conf 2020-12-16 21:44:34.000000000 +0100 +++ audit-3.0/audisp/plugins/zos-remote/audispd-zos-remote.conf 2021-02-13 21:26:36.495010422 +0100 @@ -8,7 +8,7 @@ active = no direction = out -path = /sbin/audispd-zos-remote +path = /usr/sbin/audispd-zos-remote type = always args = /etc/audisp/zos-remote.conf format = string