The zonename token records the zone in which the audit event occurred. The string “global” indicates audit events that occur in the global zone.
The zonename token contains the following fields:
A token ID that identifies this token as a zonename token
The length of the text in the following field
The name of the zone
The praudit -x command shows the content of the zonename token: