SunSHIELD Basic Security Module Guide  User Audit Fields in the
audit_user File  If it is desirable to audit some users
differently from others, the administrator may edit the
audit_user file to add audit flags for individual users. If
specified, these flags are combined with the system-wide flags
specified in the audit control file to determine which classes
of events to audit for that user. The flags the administrator
adds to the user's entry in the audit_user file modify the
defaults from the audit_control file in two ways: by specifying
a set of event classes that are never to be audited for this
user or by specifying a set of event classes that are always to
be audited.  In the audit_user file entry for each user, there
are three fields. The first field is the username, the second
field is the always-audit field, and the third is the never-
audit field. The two auditing fields are processed in sequence,
so auditing is enabled by the first field and turned off by the
second.  Note -  Avoid the common mista