syscall arguments in audit records
System call arguments are pretty useless unless you're in a process where the
memory addresses are still valid (like a testcase). Would it be useful to
put an option in at a later date that allows you to dump arguments as human
readable?
-tim