AUDIT_SCNT
#define AUDIT_SCNT 0x0400
#define AUDIT_SCNT 0x0200 /* sleep user events but not kernel events */