This responds to requests from the audit utility and notifications from the kernel. It should not be invoked manually.
auditd
auditd -d
auditd -l