This responds to requests from the audit utility and notifications from the kernel. It should not be invoked manually. More information: https://manned.org/auditd.
auditd
auditd -d
auditd -l