kaudit_to_bsm
int kaudit_to_bsm(struct kaudit_record *kar, struct au_record **pau);
error = kaudit_to_bsm(ar, &bsm);