These are the supported "fixed" events:
add_grp audit_ctl deactivate_lid add_usr audit_dmp del_nm add_usr_grp audit_evt init assign_lid audit_log mod_grp assign_nm audit_map mod_usr audit_buf date dev_audit
These are the supported "selectable" events.
access ipc_acl set_grps acct_off kill set_lvl_rng acct_on link set_pgrps acct_sw login set_sid bad_auth lp_admin set_uid bad_lvl lp_misc setrlimit cancel_job misc shm_ctl chg_dir mk_dir shm_get chg_nm mk_mld shm_op chg_root mk_node status chg_times mount sym_create cov_chan_1 msg_ctl sym_status cov_chan_2 msg_get tfadmin cov_chan_3 msg_op trunc_lvl cov_chan_4 open_rd ulimit cov_chan_5 open_wr umount cov_chan_6 page_lvl unlink cov_chan_7 passwd modpath cov_chan_8 pipe modadm create pm_denied modload cron proc_lvl moduload dac_mode prt_job lwp_create dac_own_grp prt_lvl lwp_bind def_lvl recvfd lwp_unbind disp_attr rm_dir p_online exec sched_lk logoff exit sched_fp sched_fc fcntl sched_ts lwp_exit file_acl sem_ctl lwp_kill file_lvl sem_get keyctl file_priv sem_op stop_io fork set_attr set_luid iocntl set_gid chg_priv
Search the online documentation at localhost:8457 for "Auditable events" for descriptions of each audit event listed above.