The cmd token records the list of arguments and the list of environment variables that are associated with a command.
The praudit -x command shows the fields of the cmd token. The following example is a truncated cmd token. The line is wrapped for display purposes.
<cmd><arge>WINDOWID=6823679</arge> <arge>COLORTERM=gnome-terminal</arge> <arge>...LANG=C</arge>...<arge>HOST=machine1</arge> <arge>LPDEST=printer1</arge>...</cmd>