type=SYSCALL, key= field?

Hey all,

I'm looking though the audit logs, and I'm wondering what exactly this key field is in the SYSCALL audit record. I've always seen its value be (null).

I'm not sure what this is meant to be related to, any clues?

Thanks,
Mike

auditctl -a always,exit -S open -F key=something

It's so that you can label the event with any information an admin wants.

-Steve