Remember that usage of the audit subsystem
has two stages, collection and reporting. Each stage involves
selection of audit data.
Once initiated, the subsystem collects data as directed by the
audit masks until auditing is terminated, or the system is halted.
The system maintains two types of masks: the system-wide mask that
governs default auditing done on all users, and an individual user
mask that can be defined for each user.
The user mask overrides the system-wide mask.