NEX-13644 File access audit logging
Reviewed by: Gordon Ross <gordon.ross@nexenta.com>
Reviewed by: Roman Strashkin <roman.strashkin@nexenta.com>
Reviewed by: Saso Kiselkov <saso.kiselkov@nexenta.com>
Reviewed by: Rick McNeal <rick.mcneal@nexenta.com>
Reviewed by: Yuri Pankov <yuri.pankov@nexenta.com>

*** 1,10 ****
--- 1,11 ----
  # audit_record_attr.txt
  # Two "#" are comments that are copied to audit_record_attr
  # other comments are removed.
  ##
  ## Copyright (c) 2009, 2010, Oracle and/or its affiliates. All rights reserved.
+ ## Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
  ##
  ## CDDL HEADER START
  ##
  ## The contents of this file are subject to the terms of the
  ## Common Development and Distribution License (the "License").
*** 1482,1491 ****
--- 1483,1500 ----
  # apparently replaced
  
  label=AUE_RMDIR
    format=path:[attr]
  
+ label=AUE_SACL
+   title=File Access Audit
+   syscall=none
+   see=none
+   format=head:path:arg1:[text]2:subj
+     comment="access_mask":
+     comment="Windows SID"
+ 
  label=AUE_SEMCTL
    format=arg1:[ipc]:[ipc_perm]
      comment=1, semaphore ID, "sem ID"
    note=ipc_perm
  # ipc, ipc_perm token: semctl -> ipc_lookup -> audit_ipc