AUE_CORE
class = au_event_class(AUE_CORE);
if (au_preselect(AUE_CORE, class, aumask, sorf) == 0 &&
audit_pipe_preselect(auid, AUE_CORE, class, sorf, 0) == 0)
ar = audit_new(AUE_CORE, td);
case AUE_CORE: