Hmmm ... I do not see the `/usr/bin/file' command in the audit.log ... do I something miss here? The groff and co commands are there