11037 SMB File access audit logging (reserve IDs)

*** 1,10 ****
--- 1,11 ----
  # audit_record_attr.txt
  # Two "#" are comments that are copied to audit_record_attr
  # other comments are removed.
  ##
  ## Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
+ ## Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
  ## Copyright 2019 Joyent, Inc.
  ##
  ## CDDL HEADER START
  ##
  ## The contents of this file are subject to the terms of the
*** 1483,1492 ****
--- 1484,1501 ----
  # apparently replaced
  
  label=AUE_RMDIR
    format=path:[attr]
  
+ label=AUE_SACL
+   title=File Access Audit
+   syscall=none
+   see=none
+   format=head:path:arg1:[text]2:subj
+     comment="access_mask":
+     comment="Windows SID"
+ 
  label=AUE_SEMCTL
    format=arg1:[ipc]:[ipc_perm]
      comment=1, semaphore ID, "sem ID"
    note=ipc_perm
  # ipc, ipc_perm token: semctl -> ipc_lookup -> audit_ipc