auditd and SSHD exported variables

Hello, Is there a way to log with auditd exported variables through ssd ? My servers are used by many users but with the same account. So, I export the SSH_USER variable from our "bastion" (where each user has a specific account). With this configuration I can retrieve the remote login. I use this script in /etc/profile.d/: logger -p local0.notice "`date` ": Connection from $SSH_USER@`echo $SSH_CONNECTION | cut -d " " -f1`":"`echo $SSH_CONNECTION | cut -d " " -f2` for $USER ($SSH_USER is the variable exported via SSHD) The ultimate goal is to match the following log with the "remote user" (because all users use the uid 1000 to connect to the server): type=SYSCALL msg=audit(1431694892.457:37824): arch=c000003e syscall=59 success=yes exit=0 a0=14cea68 a1=1423a48 a2=1553008 a3=0 items=2 ppid=30894 pid=30947 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts3 ses=17 comm="ls" exe="/bin/ls" key="auditcmd" type=EXECVE msg=audit(1431694892.457:37824): argc=1 a0="ls" type=CWD msg=audit(1431694892.457:37824): cwd="/root" type=PATH msg=audit(1431694892.457:37824): item=0 name="/bin/ls" inode=157 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL type=PATH msg=audit(1431694892.457:37824): item=1 name=(null) inode=4212 dev=08:01 mode=0100755 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL type=PROCTITLE msg=audit(1431694892.457:37824): proctitle="ls" Thank you in advance. Regards, -- Guillaume