A return token gives the return status of the system call and the process return value. This token is always returned as part of kernel-generated audit records for system calls. The fields are:
A token ID
The system call error status
The system call return value
A return token is displayed by praudit as follows:
return,success,0 |