On first workstation 

Edit audit_event file  

"To Add Audit Events"

"To Change Event-Class Mappings"

Edit audit_class file  

"To Add Audit Classes"

Copy for distribution (networks only) 

"To Distribute Audit Configuration Files to a Network of Workstations"