To enable auditing of the command, add the following to the Rewrite field:
-o audit <n>
Replace <n> with one of the following values:
0: Disables auditing. It has the same effect as removing the audit setting from the Rewrite field.
1: Enables auditing of all commands that are not built into the user's shell.
2: Enables auditing of all commands, including commands that are built into the user's shell. This level of auditing can affect login times.