The return token contains the return status of the system call (u_error) and the process return value (u_rval1).
The return token is always returned as part of kernel-generated audit records for system calls. In application auditing, this token indicates exit status and other return values.
The praudit command displays the return token for a system call as follows:
return,failure: Operation now in progress,-1
The praudit -x command shows the fields of the return token as follows:
<return errval="failure: Operation now in progress" retval="-1/">