The newgroups token records the groups entries from the process's credential. The newgroups token has two fixed fields: a token ID field that identifies this as a newgroups token, and a count that represents the number of groups contained in this audit record. The remainder of the token is composed of zero or more group entries. Figure A-17 shows a newgroups token.
The newgroups token is output only when the audit policy group is active. See "The auditconfig Command" for more information.