auditctl usage for filter lists: "user" , "watch" and "exclude"

[Michael C Thompson <thompsmc@us.ibm.com>]

Hey all,

I'm trying to understand better the user, watch and exclude auditctl 
filter lists. I believe I have a reasonable understanding of exclude 
from some examples Steve gave (see below), but I have very little idea 
of how user is meant to be used, and none about watch.

Any enlightenment will be helpful.

For the exclude list,

exclude,always -F msgtype=SYSCALL

seems to be the only valid structure, where msgtype can be any value 
(XXX) for the type in the audit.log? (where the 1st field in the audit 
log is type=XXX)

Are there more filters that apply? (and does it have any meaning without 
a filter?)

Any examples and/or explanations on "user" and "watch" would be appriciated.

Thanks,
Mike