/var/log/audit
NameSizeModeActions
/-0700rm
cmd: