/
proc
/
thread-self
/
root
/
usr
/
share
/
audit
/
sample-rules
/
up file
home
## Make the configuration immutable - reboot is required to change audit rules #-e 2