auditctl usage for filter lists: "user" , "watch" and "exclude"

Hey all, I'm trying to understand better the user, watch and exclude auditctl filter lists. I believe I have a reasonable understanding of exclude from some examples Steve gave (see below), but I have very little idea of how user is meant to be used, and none about watch. Any enlightenment will be helpful. For the exclude list, exclude,always -F msgtype=SYSCALL seems to be the only valid structure, where msgtype can be any value (XXX) for the type in the audit.log? (where the 1st field in the audit log is type=XXX) Are there more filters that apply? (and does it have any meaning without a filter?) Any examples and/or explanations on "user" and "watch" would be appriciated. Thanks, Mike