INSTALL

   INSTALL=keyword(,...)

   Specifies that installation event packets are to be considered
   when selecting event records. Choose from the following keywords:

   FILE=filename          Specifies the name of the installed file.
                          You can represent all or part of the name
                          with a wildcard.

                          Note that on Alpha systems prior to
                          Version 6.1, audit log files record the
                          installed file name within an object
                          name packet. To select the installed
                          file, you must use the expression
                          OBJECT=(NAME=object-name) instead of
                          FILE=filename.

   FLAGS=flag-name        Specifies the names of the flags, which
                          correspond to qualifiers of the Install
                          utility (INSTALL); for example, OPEN
                          corresponds to /OPEN.

   PRIVILEGES=privilege-  Specifies the names of the privileges with
   name                   which the file was installed.