auid=0
auid记录Audit user ID,that is the loginuid。当我使用lbh用户登录系统时，再访问audit_test，此时记录的auid为1001，具体日志如下：
type=SYSCALL msg=audit(1523513135.147:4172990525): arch=c000003e syscall=257 success=yes exit=3 a0=ffffffffffffff9c a1=1cb8550 a2=90800 a3=0 items=1 ppid=20655
pid=24299 auid=1001 uid=1001 gid=1001 euid=1001 suid=1001 fsuid=1001 egid=1001 sgid=1001 fsgid=1001 tty=pts3 ses=10868 comm="ls" exe="/usr/bin/ls" key="audit_test"
This ID is assigned to a user upon login and is inherited by every process even when the user's identity changes,
for example, by switching user accounts with the su - john command.
auid为登录用户的ID，如果是root，ID为0。并且解释更换了用户，那么每个进程事件的auid还是那个登录用户的ID。
uid=1001，gid=1001, euid=1001, suid=1001, fsuid=1001, egid=1001, sgid=1001, fsgid=1001
uid为启动这个分析进程的用户的ID，即具体执行进程的用户ID。后面分别对应着，group ID，effective user ID, set user ID, file system user ID, effective group ID, set group ID, file system group ID。
tty=pts0
具体在哪个终端tty执行的操作。如执行ls这个操作是在哪个终端进行的。
ses=10868
session ID，对话ID。
comm=ls
什么命令导致的审计记录，这里是ls，ls访问读取了这个目录，故记录了审计日志。
exe=“/usr/bin/ls”
记录可执行文件的具体路径。
下面，我们来看一下第二条记录。
type=CWD
type值为CWD，即current working directory。记录的是当前进程的位置。目的如下，先不翻译了，直接上英文吧。
The purpose of this record is to record the current process's location in case a relative path winds up being captured in the associated PATH record.
This way the absolute path can be reconstructed.
第三条记录
type=PATH
In the third record, the type field value is PATH. An Audit event contains a PATH-type record for every path that is passed to the system call as an argument. In this Audit event, only one path (/etc/ssh/sshd_config) was used as an argument.我理解应该是参数的路径
item=0
The item field indicates which item, of the total number of items referenced in the SYSCALL type record, the current record is. This number is zero-based; a value of 0means it is the first item.这个路径为命令的第一个参数。
name=.
我反问audit_test目录时，是直接在这个目录下ls的，这个name字段记录系统调用时文件或目录的full path，在目录下直接ls时，name为. 即当前路经，如果我在根目录下，ls /home/audit_test时，记录如下：
type=CWD msg=audit(1523515123.152:4172990785): cwd="/"
type=PATH msg=audit(1523515123.152:4172990785): item=0 name="/home/audit_test" inode=99213313 dev=08:11 mode=040755 ouid=0 ogid=0 rdev=00:00 objtype=NORMAL
inode=99213313
inode表示这个文件或目录的inode number，可以用如下命令来查询当前inode对应的文件。
linux-xdYUnA:~ # find / -inum 99213313 -print
/home/audit_test
可以用stat命令来查询文件或目录的inode number。
linux-xdYUnA:~ # stat /home/audit_test
File: ‘/home/audit_test’
Size: 4096 Blocks: 8 IO Block: 4096 directory
Device: 811h/2065d Inode: 99213313 Links: 2
Access: (0755/drwxr-xr-x) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2018-04-11 17:09:36.690392929 +0800
Modify: 2018-04-11 17:04:30.360408595 +0800
Change: 2018-04-11 17:09:12.849394149 +0800
Birth: -
dev=08:11
dev字段，指明device的minor和major ID。
mode=040755
mode字段表示文件或路径的权限。
ouid=0
the object owner's user ID。当我把audit_test目录的所有者改为lbh用户时，记录如下：ouid为1001。
type=PATH msg=audit(1523516175.932:4172990921): item=0 name="." inode=99213313 dev=08:11 mode=040755 ouid=1001 ogid=0 rdev=00:00 objtype=NORMAL
ogid=0
the object owner's group ID.
rdev=00:00
The rdev field contains a recorded device identifier for special files only. In this case, it is not used as the recorded file is a regular file.
objtype=NORMAL
objtype field records the intent of each path record's operation in the context of a given syscall.