11842 Want audit events for auditon(A_SETPMASK) and friends
Reviewed by: John Levon <john.levon@joyent.com>
Reviewed by: Andy Fiddaman <andy@omniosce.org>

@@ -457,10 +457,40 @@
 #       argument,3,0x14,setqctrl:aq_delay
 #       subject,tuser10,tuser10,other,root,other,3969,367,255 197121 tmach1
 #       return,failure: Not owner,-1
 #       trailer,176
 
+label=AUE_AUDITON_SETPMASK
+  format=[arg]1:[arg]2
+    comment=3, "setpmask:pid", process
+    comment=3, "setpmask:as_success", audit ID mask:
+    comment=3, "setpmask:as_failure", audit ID mask
+  syscall=auditon: SETPMASK
+
+label=AUE_AUDITON_SETKAUDIT
+  format=arg1:arg2:arg3:inaddr4:arg5:arg6:arg7
+    comment=1, audit user ID, "auid":
+    comment=1, terminal ID, "port":
+    comment=1, type, "type":
+    comment=1, terminal ID, "ip address":
+    comment=1, preselection mask, "as_success":
+    comment=1, preselection mask, "as_failure":
+    comment=1, audit session ID, "asid"
+  syscall=auditon: SETKAUDIT
+
+label=AUE_AUDITON_GETPINFO
+  format=kernel
+  syscall=auditon: GETPINFO
+
+label=AUE_AUDITON_GETKAUDIT
+  format=kernel
+  syscall=auditon: GETKAUDIT
+
+label=AUE_AUDITON_OTHER
+  format=kernel
+  syscall=auditon: OTHER
+
 label=AUE_AUDITON_STERMID
   skip=Not used.
 
 label=AUE_AUDITSTAT
   skip=Not used.