The audit rules file uses CHECK and IGNORE statements to define which attributes to track or ignore. Each attribute has an associated keyword.
The attribute keywords are as follows:
acl
all
contents
dest
devnode
dirmtime
gid
lnmtime
mode
mtime
size
type
uid
xattrs
The all keyword refers to all file attributes. See Manifest File Format.