Auditing a program use but not what it is doing