correcting audid -> auid
SYSCALL grok done
EXECVE