The attribute token contains information from the file vnode.
The attribute token usually accompanies a path token. The attribute token is produced during path searches. If a path-search error occurs, vnode is not available to obtain the necessary file information. Therefore, the attribute token is not included as part of the audit record. The praudit -x command shows the fields of the attribute token as follows:
<attribute mode="20620" uid="root" gid="tty" fsid="0" nodeid="9267" device="108233"/>