FLAGS

   FLAGS=(flag-name,...)

   Identifies the names of the audit event flags associated with the
   audited event. These names should be used in selecting records.
   Specify one or more of the following flags: ACL, Alarm, Audit,
   Flush, Foreign, Internal, and Mandatory.