Glossary: Logs and Data Sources for Investigations

SYSCALL

Also written: SYSCALL record

The audit record that says which system action happened (such as openat), whether it succeeded, which program did it, and the account IDs, including auid.