Help with audit syscall event output