How to Change Which Events Are in Which
This procedure describes how to modify the default event to class mappings.
Edit the /etc/security/audit_event file to
change the class mapping for each event to be changed.
Reboot the system or run auditconfig -conf to change the
runtime kernel event-to-class mappings.