Audit in the auditing functions refers to general audit, not particular audit. Most of the previous researches on the auditing functions strayed from this premise, and thus aroused many problems.

This call includes the source security identifier (sid), the security class (constructed from the details of the requested operation), the particular socket call, and optional auxiliary audit data.

This is sometimes used for audit purposes where we want to track a particular activity.