diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0a2fd92..d5be4d2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,8 +11,12 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 ### Changed
 
+- Update syscall, arches, and audit msg type tables for Linux 5.16. [#96](https://github.com/elastic/go-libaudit/pull/96)
+
 ### Removed
 
+- Removed support for resolving syscall numbers to names for the ia64 architecture. [#96](https://github.com/elastic/go-libaudit/pull/96)
+
 ### Deprecated
 
 ## [2.2.0]
diff --git a/Vagrantfile b/Vagrantfile
index a681dbb..be253ee 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -12,7 +12,7 @@ SCRIPT
 install_gvm = <<SCRIPT
 mkdir -p ~/bin
 if [ ! -e "~/bin/gvm" ]; then
-  curl -sL -o ~/bin/gvm https://github.com/andrewkroh/gvm/releases/download/v0.2.2/gvm-linux-amd64
+  curl -sL -o ~/bin/gvm https://github.com/andrewkroh/gvm/releases/download/v0.4.0/gvm-linux-amd64
   chmod +x ~/bin/gvm
   ~/bin/gvm #{GO_VERSION}
   echo 'export GOPATH=$HOME/go' >> ~/.bash_profile
diff --git a/auparse/defs_audit_arches.go b/auparse/defs_audit_arches.go
index db23e84..c116312 100644
--- a/auparse/defs_audit_arches.go
+++ b/auparse/defs_audit_arches.go
@@ -36,8 +36,11 @@ const (
 	AUDIT_ARCH_AARCH64     AuditArch = C.AUDIT_ARCH_AARCH64
 	AUDIT_ARCH_ARM         AuditArch = C.AUDIT_ARCH_ARM
 	AUDIT_ARCH_ARMEB       AuditArch = C.AUDIT_ARCH_ARMEB
+	AUDIT_ARCH_C6X         AuditArch = C.AUDIT_ARCH_C6X
+	AUDIT_ARCH_C6XBE       AuditArch = C.AUDIT_ARCH_C6XBE
 	AUDIT_ARCH_CRIS        AuditArch = C.AUDIT_ARCH_CRIS
 	AUDIT_ARCH_FRV         AuditArch = C.AUDIT_ARCH_FRV
+	AUDIT_ARCH_H8300       AuditArch = C.AUDIT_ARCH_H8300
 	AUDIT_ARCH_I386        AuditArch = C.AUDIT_ARCH_I386
 	AUDIT_ARCH_IA64        AuditArch = C.AUDIT_ARCH_IA64
 	AUDIT_ARCH_M32R        AuditArch = C.AUDIT_ARCH_M32R
@@ -48,6 +51,7 @@ const (
 	AUDIT_ARCH_MIPSEL      AuditArch = C.AUDIT_ARCH_MIPSEL
 	AUDIT_ARCH_MIPSEL64    AuditArch = C.AUDIT_ARCH_MIPSEL64
 	AUDIT_ARCH_MIPSEL64N32 AuditArch = C.AUDIT_ARCH_MIPSEL64N32
+	AUDIT_ARCH_NIOS2       AuditArch = C.AUDIT_ARCH_NIOS2
 	AUDIT_ARCH_PARISC      AuditArch = C.AUDIT_ARCH_PARISC
 	AUDIT_ARCH_PARISC64    AuditArch = C.AUDIT_ARCH_PARISC64
 	AUDIT_ARCH_PPC         AuditArch = C.AUDIT_ARCH_PPC
@@ -68,8 +72,11 @@ var AuditArchNames = map[AuditArch]string{
 	AUDIT_ARCH_AARCH64:     "aarch64",
 	AUDIT_ARCH_ARM:         "arm",
 	AUDIT_ARCH_ARMEB:       "armeb",
+	AUDIT_ARCH_C6X:         "c6x",
+	AUDIT_ARCH_C6XBE:       "c6xbe",
 	AUDIT_ARCH_CRIS:        "cris",
 	AUDIT_ARCH_FRV:         "frv",
+	AUDIT_ARCH_H8300:       "h8300",
 	AUDIT_ARCH_I386:        "i386",
 	AUDIT_ARCH_IA64:        "ia64",
 	AUDIT_ARCH_M32R:        "m32r",
@@ -80,6 +87,7 @@ var AuditArchNames = map[AuditArch]string{
 	AUDIT_ARCH_MIPSEL:      "mipsel",
 	AUDIT_ARCH_MIPSEL64:    "mipsel64",
 	AUDIT_ARCH_MIPSEL64N32: "mipsel64n32",
+	AUDIT_ARCH_NIOS2:       "nios2",
 	AUDIT_ARCH_PARISC:      "parisc",
 	AUDIT_ARCH_PARISC64:    "parisc64",
 	AUDIT_ARCH_PPC:         "ppc",
diff --git a/auparse/mk_audit_arches.pl b/auparse/mk_audit_arches.pl
index de12ae5..031a50d 100644
--- a/auparse/mk_audit_arches.pl
+++ b/auparse/mk_audit_arches.pl
@@ -17,7 +17,7 @@
 
 my $command = "mk_audit_arches.pl ". join(' ', @ARGV);
 
-`curl -s -O https://github.com/raw/torvalds/linux/v4.16/include/uapi/linux/audit.h`;
+`curl -s -O https://github.com/raw/torvalds/linux/v5.16/include/uapi/linux/audit.h`;
 
 open(GCC, "gcc -E -dD audit.h |") || die "can't run gcc";
 my @arches;
@@ -30,7 +30,7 @@
 close GCC;
 
 # Filter arches not known by compiler.
-@arches = grep {! /(TILE|OPENRISC|ALPHA|MICROBLAZE)/} @arches;
+@arches = grep {! /(TILE|OPENRISC|ALPHA|MICROBLAZE|ARCOMPACT|ARCV2|CSKY|HEXAGON|NDS32|RISCV|UNICORE|XTENSA)/} @arches;
 
 my $outfile = 'defs_audit_arches.go';
 open (FILE, "> $outfile") || die "problem opening $outfile\n";
diff --git a/auparse/mk_audit_exit_codes.go b/auparse/mk_audit_exit_codes.go
index 5712824..6621836 100644
--- a/auparse/mk_audit_exit_codes.go
+++ b/auparse/mk_audit_exit_codes.go
@@ -135,6 +135,9 @@ func readErrorNumbers() ([]ErrorNumber, error) {
 	}
 
 	sort.Slice(errnos, func(i, j int) bool {
+		if errnos[i].Value == errnos[j].Value {
+			return errnos[i].Name < errnos[j].Name
+		}
 		return errnos[i].Value < errnos[j].Value
 	})
 
diff --git a/auparse/mk_audit_msg_types.go b/auparse/mk_audit_msg_types.go
index 2ac1eeb..ade9c90 100644
--- a/auparse/mk_audit_msg_types.go
+++ b/auparse/mk_audit_msg_types.go
@@ -159,9 +159,9 @@ var tmpl = template.Must(template.New("message_types").Parse(fileTemplate))
 
 var (
 	headers = []string{
-		`https://github.com/raw/torvalds/linux/v4.16/include/uapi/linux/audit.h`,
-		`https://github.com/raw/linux-audit/audit-userspace/4d933301b1835cafa08b9e9ef705c8fb6c96cb62/lib/libaudit.h`,
-		`https://github.com/raw/linux-audit/audit-userspace/4d933301b1835cafa08b9e9ef705c8fb6c96cb62/lib/msg_typetab.h`,
+		`https://github.com/raw/torvalds/linux/v5.16/include/uapi/linux/audit.h`,
+		`https://github.com/raw/linux-audit/audit-userspace/v3.0.7/lib/libaudit.h`,
+		`https://github.com/raw/linux-audit/audit-userspace/v3.0.7/lib/msg_typetab.h`,
 	}
 )
 
diff --git a/auparse/mk_audit_syscalls.pl b/auparse/mk_audit_syscalls.pl
index ede0c8f..8e26d6b 100644
--- a/auparse/mk_audit_syscalls.pl
+++ b/auparse/mk_audit_syscalls.pl
@@ -22,12 +22,11 @@ sub fmt {
     print "\t\t$num: \"$name\",\n";
 }
 
-my $base_url = "https://github.com/raw/linux-audit/audit-userspace/4d933301b1835cafa08b9e9ef705c8fb6c96cb62/lib";
+my $base_url = "https://github.com/raw/linux-audit/audit-userspace/v3.0.7/lib";
 my @tables = (
     "aarch64",
     "arm",
     "i386",
-    "ia64",
     "ppc",
     "s390",
     "s390x",
diff --git a/auparse/zaudit_arches.go b/auparse/zaudit_arches.go
index 400985f..2772010 100644
--- a/auparse/zaudit_arches.go
+++ b/auparse/zaudit_arches.go
@@ -28,8 +28,11 @@ const (
 	AUDIT_ARCH_AARCH64     AuditArch = 0xc00000b7
 	AUDIT_ARCH_ARM         AuditArch = 0x40000028
 	AUDIT_ARCH_ARMEB       AuditArch = 0x28
+	AUDIT_ARCH_C6X         AuditArch = 0x4000008c
+	AUDIT_ARCH_C6XBE       AuditArch = 0x8c
 	AUDIT_ARCH_CRIS        AuditArch = 0x4000004c
 	AUDIT_ARCH_FRV         AuditArch = 0x5441
+	AUDIT_ARCH_H8300       AuditArch = 0x2e
 	AUDIT_ARCH_I386        AuditArch = 0x40000003
 	AUDIT_ARCH_IA64        AuditArch = 0xc0000032
 	AUDIT_ARCH_M32R        AuditArch = 0x58
@@ -40,6 +43,7 @@ const (
 	AUDIT_ARCH_MIPSEL      AuditArch = 0x40000008
 	AUDIT_ARCH_MIPSEL64    AuditArch = 0xc0000008
 	AUDIT_ARCH_MIPSEL64N32 AuditArch = 0xe0000008
+	AUDIT_ARCH_NIOS2       AuditArch = 0x40000071
 	AUDIT_ARCH_PARISC      AuditArch = 0xf
 	AUDIT_ARCH_PARISC64    AuditArch = 0x8000000f
 	AUDIT_ARCH_PPC         AuditArch = 0x14
@@ -60,8 +64,11 @@ var AuditArchNames = map[AuditArch]string{
 	AUDIT_ARCH_AARCH64:     "aarch64",
 	AUDIT_ARCH_ARM:         "arm",
 	AUDIT_ARCH_ARMEB:       "armeb",
+	AUDIT_ARCH_C6X:         "c6x",
+	AUDIT_ARCH_C6XBE:       "c6xbe",
 	AUDIT_ARCH_CRIS:        "cris",
 	AUDIT_ARCH_FRV:         "frv",
+	AUDIT_ARCH_H8300:       "h8300",
 	AUDIT_ARCH_I386:        "i386",
 	AUDIT_ARCH_IA64:        "ia64",
 	AUDIT_ARCH_M32R:        "m32r",
@@ -72,6 +79,7 @@ var AuditArchNames = map[AuditArch]string{
 	AUDIT_ARCH_MIPSEL:      "mipsel",
 	AUDIT_ARCH_MIPSEL64:    "mipsel64",
 	AUDIT_ARCH_MIPSEL64N32: "mipsel64n32",
+	AUDIT_ARCH_NIOS2:       "nios2",
 	AUDIT_ARCH_PARISC:      "parisc",
 	AUDIT_ARCH_PARISC64:    "parisc64",
 	AUDIT_ARCH_PPC:         "ppc",
diff --git a/auparse/zaudit_msg_types.go b/auparse/zaudit_msg_types.go
index e1d9e18..65e37ef 100644
--- a/auparse/zaudit_msg_types.go
+++ b/auparse/zaudit_msg_types.go
@@ -33,439 +33,473 @@ type AuditMessageType uint16
 
 // List of AuditMessageTypes.
 const (
-	AUDIT_GET                      AuditMessageType = 1000
-	AUDIT_SET                      AuditMessageType = 1001
-	AUDIT_LIST                     AuditMessageType = 1002
-	AUDIT_ADD                      AuditMessageType = 1003
-	AUDIT_DEL                      AuditMessageType = 1004
-	AUDIT_USER                     AuditMessageType = 1005
-	AUDIT_LOGIN                    AuditMessageType = 1006
-	AUDIT_WATCH_INS                AuditMessageType = 1007
-	AUDIT_WATCH_REM                AuditMessageType = 1008
-	AUDIT_WATCH_LIST               AuditMessageType = 1009
-	AUDIT_SIGNAL_INFO              AuditMessageType = 1010
-	AUDIT_ADD_RULE                 AuditMessageType = 1011
-	AUDIT_DEL_RULE                 AuditMessageType = 1012
-	AUDIT_LIST_RULES               AuditMessageType = 1013
-	AUDIT_TRIM                     AuditMessageType = 1014
-	AUDIT_MAKE_EQUIV               AuditMessageType = 1015
-	AUDIT_TTY_GET                  AuditMessageType = 1016
-	AUDIT_TTY_SET                  AuditMessageType = 1017
-	AUDIT_SET_FEATURE              AuditMessageType = 1018
-	AUDIT_GET_FEATURE              AuditMessageType = 1019
-	AUDIT_USER_AUTH                AuditMessageType = 1100
-	AUDIT_USER_ACCT                AuditMessageType = 1101
-	AUDIT_USER_MGMT                AuditMessageType = 1102
-	AUDIT_CRED_ACQ                 AuditMessageType = 1103
-	AUDIT_CRED_DISP                AuditMessageType = 1104
-	AUDIT_USER_START               AuditMessageType = 1105
-	AUDIT_USER_END                 AuditMessageType = 1106
-	AUDIT_USER_AVC                 AuditMessageType = 1107
-	AUDIT_USER_CHAUTHTOK           AuditMessageType = 1108
-	AUDIT_USER_ERR                 AuditMessageType = 1109
-	AUDIT_CRED_REFR                AuditMessageType = 1110
-	AUDIT_USYS_CONFIG              AuditMessageType = 1111
-	AUDIT_USER_LOGIN               AuditMessageType = 1112
-	AUDIT_USER_LOGOUT              AuditMessageType = 1113
-	AUDIT_ADD_USER                 AuditMessageType = 1114
-	AUDIT_DEL_USER                 AuditMessageType = 1115
-	AUDIT_ADD_GROUP                AuditMessageType = 1116
-	AUDIT_DEL_GROUP                AuditMessageType = 1117
-	AUDIT_DAC_CHECK                AuditMessageType = 1118
-	AUDIT_CHGRP_ID                 AuditMessageType = 1119
-	AUDIT_TEST                     AuditMessageType = 1120
-	AUDIT_TRUSTED_APP              AuditMessageType = 1121
-	AUDIT_USER_SELINUX_ERR         AuditMessageType = 1122
-	AUDIT_USER_CMD                 AuditMessageType = 1123
-	AUDIT_USER_TTY                 AuditMessageType = 1124
-	AUDIT_CHUSER_ID                AuditMessageType = 1125
-	AUDIT_GRP_AUTH                 AuditMessageType = 1126
-	AUDIT_SYSTEM_BOOT              AuditMessageType = 1127
-	AUDIT_SYSTEM_SHUTDOWN          AuditMessageType = 1128
-	AUDIT_SYSTEM_RUNLEVEL          AuditMessageType = 1129
-	AUDIT_SERVICE_START            AuditMessageType = 1130
-	AUDIT_SERVICE_STOP             AuditMessageType = 1131
-	AUDIT_GRP_MGMT                 AuditMessageType = 1132
-	AUDIT_GRP_CHAUTHTOK            AuditMessageType = 1133
-	AUDIT_MAC_CHECK                AuditMessageType = 1134
-	AUDIT_ACCT_LOCK                AuditMessageType = 1135
-	AUDIT_ACCT_UNLOCK              AuditMessageType = 1136
-	AUDIT_USER_DEVICE              AuditMessageType = 1137
-	AUDIT_SOFTWARE_UPDATE          AuditMessageType = 1138
-	AUDIT_LAST_USER_MSG            AuditMessageType = 1199
-	AUDIT_DAEMON_START             AuditMessageType = 1200
-	AUDIT_DAEMON_END               AuditMessageType = 1201
-	AUDIT_DAEMON_ABORT             AuditMessageType = 1202
-	AUDIT_DAEMON_CONFIG            AuditMessageType = 1203
-	AUDIT_DAEMON_RECONFIG          AuditMessageType = 1204
-	AUDIT_DAEMON_ROTATE            AuditMessageType = 1205
-	AUDIT_DAEMON_RESUME            AuditMessageType = 1206
-	AUDIT_DAEMON_ACCEPT            AuditMessageType = 1207
-	AUDIT_DAEMON_CLOSE             AuditMessageType = 1208
-	AUDIT_DAEMON_ERR               AuditMessageType = 1209
-	AUDIT_LAST_DAEMON              AuditMessageType = 1299
-	AUDIT_SYSCALL                  AuditMessageType = 1300
-	AUDIT_PATH                     AuditMessageType = 1302
-	AUDIT_IPC                      AuditMessageType = 1303
-	AUDIT_SOCKETCALL               AuditMessageType = 1304
-	AUDIT_CONFIG_CHANGE            AuditMessageType = 1305
-	AUDIT_SOCKADDR                 AuditMessageType = 1306
-	AUDIT_CWD                      AuditMessageType = 1307
-	AUDIT_EXECVE                   AuditMessageType = 1309
-	AUDIT_IPC_SET_PERM             AuditMessageType = 1311
-	AUDIT_MQ_OPEN                  AuditMessageType = 1312
-	AUDIT_MQ_SENDRECV              AuditMessageType = 1313
-	AUDIT_MQ_NOTIFY                AuditMessageType = 1314
-	AUDIT_MQ_GETSETATTR            AuditMessageType = 1315
-	AUDIT_KERNEL_OTHER             AuditMessageType = 1316
-	AUDIT_FD_PAIR                  AuditMessageType = 1317
-	AUDIT_OBJ_PID                  AuditMessageType = 1318
-	AUDIT_TTY                      AuditMessageType = 1319
-	AUDIT_EOE                      AuditMessageType = 1320
-	AUDIT_BPRM_FCAPS               AuditMessageType = 1321
-	AUDIT_CAPSET                   AuditMessageType = 1322
-	AUDIT_MMAP                     AuditMessageType = 1323
-	AUDIT_NETFILTER_PKT            AuditMessageType = 1324
-	AUDIT_NETFILTER_CFG            AuditMessageType = 1325
-	AUDIT_SECCOMP                  AuditMessageType = 1326
-	AUDIT_PROCTITLE                AuditMessageType = 1327
-	AUDIT_FEATURE_CHANGE           AuditMessageType = 1328
-	AUDIT_REPLACE                  AuditMessageType = 1329
-	AUDIT_KERN_MODULE              AuditMessageType = 1330
-	AUDIT_FANOTIFY                 AuditMessageType = 1331
-	AUDIT_LAST_EVENT               AuditMessageType = 1399
-	AUDIT_AVC                      AuditMessageType = 1400
-	AUDIT_SELINUX_ERR              AuditMessageType = 1401
-	AUDIT_AVC_PATH                 AuditMessageType = 1402
-	AUDIT_MAC_POLICY_LOAD          AuditMessageType = 1403
-	AUDIT_MAC_STATUS               AuditMessageType = 1404
-	AUDIT_MAC_CONFIG_CHANGE        AuditMessageType = 1405
-	AUDIT_MAC_UNLBL_ALLOW          AuditMessageType = 1406
-	AUDIT_MAC_CIPSOV4_ADD          AuditMessageType = 1407
-	AUDIT_MAC_CIPSOV4_DEL          AuditMessageType = 1408
-	AUDIT_MAC_MAP_ADD              AuditMessageType = 1409
-	AUDIT_MAC_MAP_DEL              AuditMessageType = 1410
-	AUDIT_MAC_IPSEC_ADDSA          AuditMessageType = 1411
-	AUDIT_MAC_IPSEC_DELSA          AuditMessageType = 1412
-	AUDIT_MAC_IPSEC_ADDSPD         AuditMessageType = 1413
-	AUDIT_MAC_IPSEC_DELSPD         AuditMessageType = 1414
-	AUDIT_MAC_IPSEC_EVENT          AuditMessageType = 1415
-	AUDIT_MAC_UNLBL_STCADD         AuditMessageType = 1416
-	AUDIT_MAC_UNLBL_STCDEL         AuditMessageType = 1417
-	AUDIT_MAC_CALIPSO_ADD          AuditMessageType = 1418
-	AUDIT_MAC_CALIPSO_DEL          AuditMessageType = 1419
-	AUDIT_LAST_SELINUX             AuditMessageType = 1499
-	AUDIT_AA                       AuditMessageType = 1500
-	AUDIT_APPARMOR_AUDIT           AuditMessageType = 1501
-	AUDIT_APPARMOR_ALLOWED         AuditMessageType = 1502
-	AUDIT_APPARMOR_DENIED          AuditMessageType = 1503
-	AUDIT_APPARMOR_HINT            AuditMessageType = 1504
-	AUDIT_APPARMOR_STATUS          AuditMessageType = 1505
-	AUDIT_APPARMOR_ERROR           AuditMessageType = 1506
-	AUDIT_LAST_APPARMOR            AuditMessageType = 1599
-	AUDIT_FIRST_KERN_CRYPTO_MSG    AuditMessageType = 1600
-	AUDIT_LAST_KERN_CRYPTO_MSG     AuditMessageType = 1699
-	AUDIT_ANOM_PROMISCUOUS         AuditMessageType = 1700
-	AUDIT_ANOM_ABEND               AuditMessageType = 1701
-	AUDIT_ANOM_LINK                AuditMessageType = 1702
-	AUDIT_LAST_KERN_ANOM_MSG       AuditMessageType = 1799
-	AUDIT_INTEGRITY_DATA           AuditMessageType = 1800
-	AUDIT_INTEGRITY_METADATA       AuditMessageType = 1801
-	AUDIT_INTEGRITY_STATUS         AuditMessageType = 1802
-	AUDIT_INTEGRITY_HASH           AuditMessageType = 1803
-	AUDIT_INTEGRITY_PCR            AuditMessageType = 1804
-	AUDIT_INTEGRITY_RULE           AuditMessageType = 1805
-	AUDIT_INTEGRITY_LAST_MSG       AuditMessageType = 1899
-	AUDIT_KERNEL                   AuditMessageType = 2000
-	AUDIT_ANOM_LOGIN_FAILURES      AuditMessageType = 2100
-	AUDIT_ANOM_LOGIN_TIME          AuditMessageType = 2101
-	AUDIT_ANOM_LOGIN_SESSIONS      AuditMessageType = 2102
-	AUDIT_ANOM_LOGIN_ACCT          AuditMessageType = 2103
-	AUDIT_ANOM_LOGIN_LOCATION      AuditMessageType = 2104
-	AUDIT_ANOM_MAX_DAC             AuditMessageType = 2105
-	AUDIT_ANOM_MAX_MAC             AuditMessageType = 2106
-	AUDIT_ANOM_AMTU_FAIL           AuditMessageType = 2107
-	AUDIT_ANOM_RBAC_FAIL           AuditMessageType = 2108
-	AUDIT_ANOM_RBAC_INTEGRITY_FAIL AuditMessageType = 2109
-	AUDIT_ANOM_CRYPTO_FAIL         AuditMessageType = 2110
-	AUDIT_ANOM_ACCESS_FS           AuditMessageType = 2111
-	AUDIT_ANOM_EXEC                AuditMessageType = 2112
-	AUDIT_ANOM_MK_EXEC             AuditMessageType = 2113
-	AUDIT_ANOM_ADD_ACCT            AuditMessageType = 2114
-	AUDIT_ANOM_DEL_ACCT            AuditMessageType = 2115
-	AUDIT_ANOM_MOD_ACCT            AuditMessageType = 2116
-	AUDIT_ANOM_ROOT_TRANS          AuditMessageType = 2117
-	AUDIT_ANOM_LOGIN_SERVICE       AuditMessageType = 2118
-	AUDIT_LAST_ANOM_MSG            AuditMessageType = 2199
-	AUDIT_RESP_ANOMALY             AuditMessageType = 2200
-	AUDIT_RESP_ALERT               AuditMessageType = 2201
-	AUDIT_RESP_KILL_PROC           AuditMessageType = 2202
-	AUDIT_RESP_TERM_ACCESS         AuditMessageType = 2203
-	AUDIT_RESP_ACCT_REMOTE         AuditMessageType = 2204
-	AUDIT_RESP_ACCT_LOCK_TIMED     AuditMessageType = 2205
-	AUDIT_RESP_ACCT_UNLOCK_TIMED   AuditMessageType = 2206
-	AUDIT_RESP_ACCT_LOCK           AuditMessageType = 2207
-	AUDIT_RESP_TERM_LOCK           AuditMessageType = 2208
-	AUDIT_RESP_SEBOOL              AuditMessageType = 2209
-	AUDIT_RESP_EXEC                AuditMessageType = 2210
-	AUDIT_RESP_SINGLE              AuditMessageType = 2211
-	AUDIT_RESP_HALT                AuditMessageType = 2212
-	AUDIT_RESP_ORIGIN_BLOCK        AuditMessageType = 2213
-	AUDIT_RESP_ORIGIN_BLOCK_TIMED  AuditMessageType = 2214
-	AUDIT_LAST_ANOM_RESP           AuditMessageType = 2299
-	AUDIT_USER_ROLE_CHANGE         AuditMessageType = 2300
-	AUDIT_ROLE_ASSIGN              AuditMessageType = 2301
-	AUDIT_ROLE_REMOVE              AuditMessageType = 2302
-	AUDIT_LABEL_OVERRIDE           AuditMessageType = 2303
-	AUDIT_LABEL_LEVEL_CHANGE       AuditMessageType = 2304
-	AUDIT_USER_LABELED_EXPORT      AuditMessageType = 2305
-	AUDIT_USER_UNLABELED_EXPORT    AuditMessageType = 2306
-	AUDIT_DEV_ALLOC                AuditMessageType = 2307
-	AUDIT_DEV_DEALLOC              AuditMessageType = 2308
-	AUDIT_FS_RELABEL               AuditMessageType = 2309
-	AUDIT_USER_MAC_POLICY_LOAD     AuditMessageType = 2310
-	AUDIT_ROLE_MODIFY              AuditMessageType = 2311
-	AUDIT_USER_MAC_CONFIG_CHANGE   AuditMessageType = 2312
-	AUDIT_LAST_USER_LSPP_MSG       AuditMessageType = 2399
-	AUDIT_CRYPTO_TEST_USER         AuditMessageType = 2400
-	AUDIT_CRYPTO_PARAM_CHANGE_USER AuditMessageType = 2401
-	AUDIT_CRYPTO_LOGIN             AuditMessageType = 2402
-	AUDIT_CRYPTO_LOGOUT            AuditMessageType = 2403
-	AUDIT_CRYPTO_KEY_USER          AuditMessageType = 2404
-	AUDIT_CRYPTO_FAILURE_USER      AuditMessageType = 2405
-	AUDIT_CRYPTO_REPLAY_USER       AuditMessageType = 2406
-	AUDIT_CRYPTO_SESSION           AuditMessageType = 2407
-	AUDIT_CRYPTO_IKE_SA            AuditMessageType = 2408
-	AUDIT_CRYPTO_IPSEC_SA          AuditMessageType = 2409
-	AUDIT_LAST_CRYPTO_MSG          AuditMessageType = 2499
-	AUDIT_VIRT_CONTROL             AuditMessageType = 2500
-	AUDIT_VIRT_RESOURCE            AuditMessageType = 2501
-	AUDIT_VIRT_MACHINE_ID          AuditMessageType = 2502
-	AUDIT_VIRT_INTEGRITY_CHECK     AuditMessageType = 2503
-	AUDIT_VIRT_CREATE              AuditMessageType = 2504
-	AUDIT_VIRT_DESTROY             AuditMessageType = 2505
-	AUDIT_VIRT_MIGRATE_IN          AuditMessageType = 2506
-	AUDIT_VIRT_MIGRATE_OUT         AuditMessageType = 2507
-	AUDIT_LAST_VIRT_MSG            AuditMessageType = 2599
-	AUDIT_LAST_USER_MSG2           AuditMessageType = 2999
+	AUDIT_GET                       AuditMessageType = 1000
+	AUDIT_SET                       AuditMessageType = 1001
+	AUDIT_LIST                      AuditMessageType = 1002
+	AUDIT_ADD                       AuditMessageType = 1003
+	AUDIT_DEL                       AuditMessageType = 1004
+	AUDIT_USER                      AuditMessageType = 1005
+	AUDIT_LOGIN                     AuditMessageType = 1006
+	AUDIT_WATCH_INS                 AuditMessageType = 1007
+	AUDIT_WATCH_REM                 AuditMessageType = 1008
+	AUDIT_WATCH_LIST                AuditMessageType = 1009
+	AUDIT_SIGNAL_INFO               AuditMessageType = 1010
+	AUDIT_ADD_RULE                  AuditMessageType = 1011
+	AUDIT_DEL_RULE                  AuditMessageType = 1012
+	AUDIT_LIST_RULES                AuditMessageType = 1013
+	AUDIT_TRIM                      AuditMessageType = 1014
+	AUDIT_MAKE_EQUIV                AuditMessageType = 1015
+	AUDIT_TTY_GET                   AuditMessageType = 1016
+	AUDIT_TTY_SET                   AuditMessageType = 1017
+	AUDIT_SET_FEATURE               AuditMessageType = 1018
+	AUDIT_GET_FEATURE               AuditMessageType = 1019
+	AUDIT_USER_AUTH                 AuditMessageType = 1100
+	AUDIT_USER_ACCT                 AuditMessageType = 1101
+	AUDIT_USER_MGMT                 AuditMessageType = 1102
+	AUDIT_CRED_ACQ                  AuditMessageType = 1103
+	AUDIT_CRED_DISP                 AuditMessageType = 1104
+	AUDIT_USER_START                AuditMessageType = 1105
+	AUDIT_USER_END                  AuditMessageType = 1106
+	AUDIT_USER_AVC                  AuditMessageType = 1107
+	AUDIT_USER_CHAUTHTOK            AuditMessageType = 1108
+	AUDIT_USER_ERR                  AuditMessageType = 1109
+	AUDIT_CRED_REFR                 AuditMessageType = 1110
+	AUDIT_USYS_CONFIG               AuditMessageType = 1111
+	AUDIT_USER_LOGIN                AuditMessageType = 1112
+	AUDIT_USER_LOGOUT               AuditMessageType = 1113
+	AUDIT_ADD_USER                  AuditMessageType = 1114
+	AUDIT_DEL_USER                  AuditMessageType = 1115
+	AUDIT_ADD_GROUP                 AuditMessageType = 1116
+	AUDIT_DEL_GROUP                 AuditMessageType = 1117
+	AUDIT_DAC_CHECK                 AuditMessageType = 1118
+	AUDIT_CHGRP_ID                  AuditMessageType = 1119
+	AUDIT_TEST                      AuditMessageType = 1120
+	AUDIT_TRUSTED_APP               AuditMessageType = 1121
+	AUDIT_USER_SELINUX_ERR          AuditMessageType = 1122
+	AUDIT_USER_CMD                  AuditMessageType = 1123
+	AUDIT_USER_TTY                  AuditMessageType = 1124
+	AUDIT_CHUSER_ID                 AuditMessageType = 1125
+	AUDIT_GRP_AUTH                  AuditMessageType = 1126
+	AUDIT_SYSTEM_BOOT               AuditMessageType = 1127
+	AUDIT_SYSTEM_SHUTDOWN           AuditMessageType = 1128
+	AUDIT_SYSTEM_RUNLEVEL           AuditMessageType = 1129
+	AUDIT_SERVICE_START             AuditMessageType = 1130
+	AUDIT_SERVICE_STOP              AuditMessageType = 1131
+	AUDIT_GRP_MGMT                  AuditMessageType = 1132
+	AUDIT_GRP_CHAUTHTOK             AuditMessageType = 1133
+	AUDIT_MAC_CHECK                 AuditMessageType = 1134
+	AUDIT_ACCT_LOCK                 AuditMessageType = 1135
+	AUDIT_ACCT_UNLOCK               AuditMessageType = 1136
+	AUDIT_USER_DEVICE               AuditMessageType = 1137
+	AUDIT_SOFTWARE_UPDATE           AuditMessageType = 1138
+	AUDIT_LAST_USER_MSG             AuditMessageType = 1199
+	AUDIT_DAEMON_START              AuditMessageType = 1200
+	AUDIT_DAEMON_END                AuditMessageType = 1201
+	AUDIT_DAEMON_ABORT              AuditMessageType = 1202
+	AUDIT_DAEMON_CONFIG             AuditMessageType = 1203
+	AUDIT_DAEMON_RECONFIG           AuditMessageType = 1204
+	AUDIT_DAEMON_ROTATE             AuditMessageType = 1205
+	AUDIT_DAEMON_RESUME             AuditMessageType = 1206
+	AUDIT_DAEMON_ACCEPT             AuditMessageType = 1207
+	AUDIT_DAEMON_CLOSE              AuditMessageType = 1208
+	AUDIT_DAEMON_ERR                AuditMessageType = 1209
+	AUDIT_LAST_DAEMON               AuditMessageType = 1299
+	AUDIT_SYSCALL                   AuditMessageType = 1300
+	AUDIT_PATH                      AuditMessageType = 1302
+	AUDIT_IPC                       AuditMessageType = 1303
+	AUDIT_SOCKETCALL                AuditMessageType = 1304
+	AUDIT_CONFIG_CHANGE             AuditMessageType = 1305
+	AUDIT_SOCKADDR                  AuditMessageType = 1306
+	AUDIT_CWD                       AuditMessageType = 1307
+	AUDIT_EXECVE                    AuditMessageType = 1309
+	AUDIT_IPC_SET_PERM              AuditMessageType = 1311
+	AUDIT_MQ_OPEN                   AuditMessageType = 1312
+	AUDIT_MQ_SENDRECV               AuditMessageType = 1313
+	AUDIT_MQ_NOTIFY                 AuditMessageType = 1314
+	AUDIT_MQ_GETSETATTR             AuditMessageType = 1315
+	AUDIT_KERNEL_OTHER              AuditMessageType = 1316
+	AUDIT_FD_PAIR                   AuditMessageType = 1317
+	AUDIT_OBJ_PID                   AuditMessageType = 1318
+	AUDIT_TTY                       AuditMessageType = 1319
+	AUDIT_EOE                       AuditMessageType = 1320
+	AUDIT_BPRM_FCAPS                AuditMessageType = 1321
+	AUDIT_CAPSET                    AuditMessageType = 1322
+	AUDIT_MMAP                      AuditMessageType = 1323
+	AUDIT_NETFILTER_PKT             AuditMessageType = 1324
+	AUDIT_NETFILTER_CFG             AuditMessageType = 1325
+	AUDIT_SECCOMP                   AuditMessageType = 1326
+	AUDIT_PROCTITLE                 AuditMessageType = 1327
+	AUDIT_FEATURE_CHANGE            AuditMessageType = 1328
+	AUDIT_REPLACE                   AuditMessageType = 1329
+	AUDIT_KERN_MODULE               AuditMessageType = 1330
+	AUDIT_FANOTIFY                  AuditMessageType = 1331
+	AUDIT_TIME_INJOFFSET            AuditMessageType = 1332
+	AUDIT_TIME_ADJNTPVAL            AuditMessageType = 1333
+	AUDIT_BPF                       AuditMessageType = 1334
+	AUDIT_EVENT_LISTENER            AuditMessageType = 1335
+	AUDIT_URINGOP                   AuditMessageType = 1336
+	AUDIT_OPENAT2                   AuditMessageType = 1337
+	AUDIT_DM_CTRL                   AuditMessageType = 1338
+	AUDIT_DM_EVENT                  AuditMessageType = 1339
+	AUDIT_LAST_EVENT                AuditMessageType = 1399
+	AUDIT_AVC                       AuditMessageType = 1400
+	AUDIT_SELINUX_ERR               AuditMessageType = 1401
+	AUDIT_AVC_PATH                  AuditMessageType = 1402
+	AUDIT_MAC_POLICY_LOAD           AuditMessageType = 1403
+	AUDIT_MAC_STATUS                AuditMessageType = 1404
+	AUDIT_MAC_CONFIG_CHANGE         AuditMessageType = 1405
+	AUDIT_MAC_UNLBL_ALLOW           AuditMessageType = 1406
+	AUDIT_MAC_CIPSOV4_ADD           AuditMessageType = 1407
+	AUDIT_MAC_CIPSOV4_DEL           AuditMessageType = 1408
+	AUDIT_MAC_MAP_ADD               AuditMessageType = 1409
+	AUDIT_MAC_MAP_DEL               AuditMessageType = 1410
+	AUDIT_MAC_IPSEC_ADDSA           AuditMessageType = 1411
+	AUDIT_MAC_IPSEC_DELSA           AuditMessageType = 1412
+	AUDIT_MAC_IPSEC_ADDSPD          AuditMessageType = 1413
+	AUDIT_MAC_IPSEC_DELSPD          AuditMessageType = 1414
+	AUDIT_MAC_IPSEC_EVENT           AuditMessageType = 1415
+	AUDIT_MAC_UNLBL_STCADD          AuditMessageType = 1416
+	AUDIT_MAC_UNLBL_STCDEL          AuditMessageType = 1417
+	AUDIT_MAC_CALIPSO_ADD           AuditMessageType = 1418
+	AUDIT_MAC_CALIPSO_DEL           AuditMessageType = 1419
+	AUDIT_LAST_SELINUX              AuditMessageType = 1499
+	AUDIT_AA                        AuditMessageType = 1500
+	AUDIT_APPARMOR_AUDIT            AuditMessageType = 1501
+	AUDIT_APPARMOR_ALLOWED          AuditMessageType = 1502
+	AUDIT_APPARMOR_DENIED           AuditMessageType = 1503
+	AUDIT_APPARMOR_HINT             AuditMessageType = 1504
+	AUDIT_APPARMOR_STATUS           AuditMessageType = 1505
+	AUDIT_APPARMOR_ERROR            AuditMessageType = 1506
+	AUDIT_APPARMOR_KILL             AuditMessageType = 1507
+	AUDIT_LAST_APPARMOR             AuditMessageType = 1599
+	AUDIT_FIRST_KERN_CRYPTO_MSG     AuditMessageType = 1600
+	AUDIT_LAST_KERN_CRYPTO_MSG      AuditMessageType = 1699
+	AUDIT_ANOM_PROMISCUOUS          AuditMessageType = 1700
+	AUDIT_ANOM_ABEND                AuditMessageType = 1701
+	AUDIT_ANOM_LINK                 AuditMessageType = 1702
+	AUDIT_ANOM_CREAT                AuditMessageType = 1703
+	AUDIT_LAST_KERN_ANOM_MSG        AuditMessageType = 1799
+	AUDIT_INTEGRITY_DATA            AuditMessageType = 1800
+	AUDIT_INTEGRITY_METADATA        AuditMessageType = 1801
+	AUDIT_INTEGRITY_STATUS          AuditMessageType = 1802
+	AUDIT_INTEGRITY_HASH            AuditMessageType = 1803
+	AUDIT_INTEGRITY_PCR             AuditMessageType = 1804
+	AUDIT_INTEGRITY_RULE            AuditMessageType = 1805
+	AUDIT_INTEGRITY_EVM_XATTR       AuditMessageType = 1806
+	AUDIT_INTEGRITY_POLICY_RULE     AuditMessageType = 1807
+	AUDIT_INTEGRITY_LAST_MSG        AuditMessageType = 1899
+	AUDIT_KERNEL                    AuditMessageType = 2000
+	AUDIT_ANOM_LOGIN_FAILURES       AuditMessageType = 2100
+	AUDIT_ANOM_LOGIN_TIME           AuditMessageType = 2101
+	AUDIT_ANOM_LOGIN_SESSIONS       AuditMessageType = 2102
+	AUDIT_ANOM_LOGIN_ACCT           AuditMessageType = 2103
+	AUDIT_ANOM_LOGIN_LOCATION       AuditMessageType = 2104
+	AUDIT_ANOM_MAX_DAC              AuditMessageType = 2105
+	AUDIT_ANOM_MAX_MAC              AuditMessageType = 2106
+	AUDIT_ANOM_AMTU_FAIL            AuditMessageType = 2107
+	AUDIT_ANOM_RBAC_FAIL            AuditMessageType = 2108
+	AUDIT_ANOM_RBAC_INTEGRITY_FAIL  AuditMessageType = 2109
+	AUDIT_ANOM_CRYPTO_FAIL          AuditMessageType = 2110
+	AUDIT_ANOM_ACCESS_FS            AuditMessageType = 2111
+	AUDIT_ANOM_EXEC                 AuditMessageType = 2112
+	AUDIT_ANOM_MK_EXEC              AuditMessageType = 2113
+	AUDIT_ANOM_ADD_ACCT             AuditMessageType = 2114
+	AUDIT_ANOM_DEL_ACCT             AuditMessageType = 2115
+	AUDIT_ANOM_MOD_ACCT             AuditMessageType = 2116
+	AUDIT_ANOM_ROOT_TRANS           AuditMessageType = 2117
+	AUDIT_ANOM_LOGIN_SERVICE        AuditMessageType = 2118
+	AUDIT_ANOM_LOGIN_ROOT           AuditMessageType = 2119
+	AUDIT_ANOM_ORIGIN_FAILURES      AuditMessageType = 2120
+	AUDIT_ANOM_SESSION              AuditMessageType = 2121
+	AUDIT_LAST_ANOM_MSG             AuditMessageType = 2199
+	AUDIT_RESP_ANOMALY              AuditMessageType = 2200
+	AUDIT_RESP_ALERT                AuditMessageType = 2201
+	AUDIT_RESP_KILL_PROC            AuditMessageType = 2202
+	AUDIT_RESP_TERM_ACCESS          AuditMessageType = 2203
+	AUDIT_RESP_ACCT_REMOTE          AuditMessageType = 2204
+	AUDIT_RESP_ACCT_LOCK_TIMED      AuditMessageType = 2205
+	AUDIT_RESP_ACCT_UNLOCK_TIMED    AuditMessageType = 2206
+	AUDIT_RESP_ACCT_LOCK            AuditMessageType = 2207
+	AUDIT_RESP_TERM_LOCK            AuditMessageType = 2208
+	AUDIT_RESP_SEBOOL               AuditMessageType = 2209
+	AUDIT_RESP_EXEC                 AuditMessageType = 2210
+	AUDIT_RESP_SINGLE               AuditMessageType = 2211
+	AUDIT_RESP_HALT                 AuditMessageType = 2212
+	AUDIT_RESP_ORIGIN_BLOCK         AuditMessageType = 2213
+	AUDIT_RESP_ORIGIN_BLOCK_TIMED   AuditMessageType = 2214
+	AUDIT_RESP_ORIGIN_UNBLOCK_TIMED AuditMessageType = 2215
+	AUDIT_LAST_ANOM_RESP            AuditMessageType = 2299
+	AUDIT_USER_ROLE_CHANGE          AuditMessageType = 2300
+	AUDIT_ROLE_ASSIGN               AuditMessageType = 2301
+	AUDIT_ROLE_REMOVE               AuditMessageType = 2302
+	AUDIT_LABEL_OVERRIDE            AuditMessageType = 2303
+	AUDIT_LABEL_LEVEL_CHANGE        AuditMessageType = 2304
+	AUDIT_USER_LABELED_EXPORT       AuditMessageType = 2305
+	AUDIT_USER_UNLABELED_EXPORT     AuditMessageType = 2306
+	AUDIT_DEV_ALLOC                 AuditMessageType = 2307
+	AUDIT_DEV_DEALLOC               AuditMessageType = 2308
+	AUDIT_FS_RELABEL                AuditMessageType = 2309
+	AUDIT_USER_MAC_POLICY_LOAD      AuditMessageType = 2310
+	AUDIT_ROLE_MODIFY               AuditMessageType = 2311
+	AUDIT_USER_MAC_CONFIG_CHANGE    AuditMessageType = 2312
+	AUDIT_USER_MAC_STATUS           AuditMessageType = 2313
+	AUDIT_LAST_USER_LSPP_MSG        AuditMessageType = 2399
+	AUDIT_CRYPTO_TEST_USER          AuditMessageType = 2400
+	AUDIT_CRYPTO_PARAM_CHANGE_USER  AuditMessageType = 2401
+	AUDIT_CRYPTO_LOGIN              AuditMessageType = 2402
+	AUDIT_CRYPTO_LOGOUT             AuditMessageType = 2403
+	AUDIT_CRYPTO_KEY_USER           AuditMessageType = 2404
+	AUDIT_CRYPTO_FAILURE_USER       AuditMessageType = 2405
+	AUDIT_CRYPTO_REPLAY_USER        AuditMessageType = 2406
+	AUDIT_CRYPTO_SESSION            AuditMessageType = 2407
+	AUDIT_CRYPTO_IKE_SA             AuditMessageType = 2408
+	AUDIT_CRYPTO_IPSEC_SA           AuditMessageType = 2409
+	AUDIT_LAST_CRYPTO_MSG           AuditMessageType = 2499
+	AUDIT_VIRT_CONTROL              AuditMessageType = 2500
+	AUDIT_VIRT_RESOURCE             AuditMessageType = 2501
+	AUDIT_VIRT_MACHINE_ID           AuditMessageType = 2502
+	AUDIT_VIRT_INTEGRITY_CHECK      AuditMessageType = 2503
+	AUDIT_VIRT_CREATE               AuditMessageType = 2504
+	AUDIT_VIRT_DESTROY              AuditMessageType = 2505
+	AUDIT_VIRT_MIGRATE_IN           AuditMessageType = 2506
+	AUDIT_VIRT_MIGRATE_OUT          AuditMessageType = 2507
+	AUDIT_LAST_VIRT_MSG             AuditMessageType = 2599
+	AUDIT_LAST_USER_MSG2            AuditMessageType = 2999
 )
 
 var auditMessageTypeToName = map[AuditMessageType]string{
-	AUDIT_AA:                       "APPARMOR",
-	AUDIT_ACCT_LOCK:                "ACCT_LOCK",
-	AUDIT_ACCT_UNLOCK:              "ACCT_UNLOCK",
-	AUDIT_ADD:                      "ADD",
-	AUDIT_ADD_GROUP:                "ADD_GROUP",
-	AUDIT_ADD_RULE:                 "ADD_RULE",
-	AUDIT_ADD_USER:                 "ADD_USER",
-	AUDIT_ANOM_ABEND:               "ANOM_ABEND",
-	AUDIT_ANOM_ACCESS_FS:           "ANOM_ACCESS_FS",
-	AUDIT_ANOM_ADD_ACCT:            "ANOM_ADD_ACCT",
-	AUDIT_ANOM_AMTU_FAIL:           "ANOM_AMTU_FAIL",
-	AUDIT_ANOM_CRYPTO_FAIL:         "ANOM_CRYPTO_FAIL",
-	AUDIT_ANOM_DEL_ACCT:            "ANOM_DEL_ACCT",
-	AUDIT_ANOM_EXEC:                "ANOM_EXEC",
-	AUDIT_ANOM_LINK:                "ANOM_LINK",
-	AUDIT_ANOM_LOGIN_ACCT:          "ANOM_LOGIN_ACCT",
-	AUDIT_ANOM_LOGIN_FAILURES:      "ANOM_LOGIN_FAILURES",
-	AUDIT_ANOM_LOGIN_LOCATION:      "ANOM_LOGIN_LOCATION",
-	AUDIT_ANOM_LOGIN_SERVICE:       "ANOM_LOGIN_SERVICE",
-	AUDIT_ANOM_LOGIN_SESSIONS:      "ANOM_LOGIN_SESSIONS",
-	AUDIT_ANOM_LOGIN_TIME:          "ANOM_LOGIN_TIME",
-	AUDIT_ANOM_MAX_DAC:             "ANOM_MAX_DAC",
-	AUDIT_ANOM_MAX_MAC:             "ANOM_MAX_MAC",
-	AUDIT_ANOM_MK_EXEC:             "ANOM_MK_EXEC",
-	AUDIT_ANOM_MOD_ACCT:            "ANOM_MOD_ACCT",
-	AUDIT_ANOM_PROMISCUOUS:         "ANOM_PROMISCUOUS",
-	AUDIT_ANOM_RBAC_FAIL:           "ANOM_RBAC_FAIL",
-	AUDIT_ANOM_RBAC_INTEGRITY_FAIL: "ANOM_RBAC_INTEGRITY_FAIL",
-	AUDIT_ANOM_ROOT_TRANS:          "ANOM_ROOT_TRANS",
-	AUDIT_APPARMOR_ALLOWED:         "APPARMOR_ALLOWED",
-	AUDIT_APPARMOR_AUDIT:           "APPARMOR_AUDIT",
-	AUDIT_APPARMOR_DENIED:          "APPARMOR_DENIED",
-	AUDIT_APPARMOR_ERROR:           "APPARMOR_ERROR",
-	AUDIT_APPARMOR_HINT:            "APPARMOR_HINT",
-	AUDIT_APPARMOR_STATUS:          "APPARMOR_STATUS",
-	AUDIT_AVC:                      "AVC",
-	AUDIT_AVC_PATH:                 "AVC_PATH",
-	AUDIT_BPRM_FCAPS:               "BPRM_FCAPS",
-	AUDIT_CAPSET:                   "CAPSET",
-	AUDIT_CHGRP_ID:                 "CHGRP_ID",
-	AUDIT_CHUSER_ID:                "CHUSER_ID",
-	AUDIT_CONFIG_CHANGE:            "CONFIG_CHANGE",
-	AUDIT_CRED_ACQ:                 "CRED_ACQ",
-	AUDIT_CRED_DISP:                "CRED_DISP",
-	AUDIT_CRED_REFR:                "CRED_REFR",
-	AUDIT_CRYPTO_FAILURE_USER:      "CRYPTO_FAILURE_USER",
-	AUDIT_CRYPTO_IKE_SA:            "CRYPTO_IKE_SA",
-	AUDIT_CRYPTO_IPSEC_SA:          "CRYPTO_IPSEC_SA",
-	AUDIT_CRYPTO_KEY_USER:          "CRYPTO_KEY_USER",
-	AUDIT_CRYPTO_LOGIN:             "CRYPTO_LOGIN",
-	AUDIT_CRYPTO_LOGOUT:            "CRYPTO_LOGOUT",
-	AUDIT_CRYPTO_PARAM_CHANGE_USER: "CRYPTO_PARAM_CHANGE_USER",
-	AUDIT_CRYPTO_REPLAY_USER:       "CRYPTO_REPLAY_USER",
-	AUDIT_CRYPTO_SESSION:           "CRYPTO_SESSION",
-	AUDIT_CRYPTO_TEST_USER:         "CRYPTO_TEST_USER",
-	AUDIT_CWD:                      "CWD",
-	AUDIT_DAC_CHECK:                "DAC_CHECK",
-	AUDIT_DAEMON_ABORT:             "DAEMON_ABORT",
-	AUDIT_DAEMON_ACCEPT:            "DAEMON_ACCEPT",
-	AUDIT_DAEMON_CLOSE:             "DAEMON_CLOSE",
-	AUDIT_DAEMON_CONFIG:            "DAEMON_CONFIG",
-	AUDIT_DAEMON_END:               "DAEMON_END",
-	AUDIT_DAEMON_ERR:               "DAEMON_ERR",
-	AUDIT_DAEMON_RECONFIG:          "DAEMON_RECONFIG",
-	AUDIT_DAEMON_RESUME:            "DAEMON_RESUME",
-	AUDIT_DAEMON_ROTATE:            "DAEMON_ROTATE",
-	AUDIT_DAEMON_START:             "DAEMON_START",
-	AUDIT_DEL:                      "DEL",
-	AUDIT_DEL_GROUP:                "DEL_GROUP",
-	AUDIT_DEL_RULE:                 "DEL_RULE",
-	AUDIT_DEL_USER:                 "DEL_USER",
-	AUDIT_DEV_ALLOC:                "DEV_ALLOC",
-	AUDIT_DEV_DEALLOC:              "DEV_DEALLOC",
-	AUDIT_EOE:                      "EOE",
-	AUDIT_EXECVE:                   "EXECVE",
-	AUDIT_FANOTIFY:                 "FANOTIFY",
-	AUDIT_FD_PAIR:                  "FD_PAIR",
-	AUDIT_FEATURE_CHANGE:           "FEATURE_CHANGE",
-	AUDIT_FIRST_KERN_CRYPTO_MSG:    "FIRST_KERN_CRYPTO_MSG",
-	AUDIT_FS_RELABEL:               "FS_RELABEL",
-	AUDIT_GET:                      "GET",
-	AUDIT_GET_FEATURE:              "GET_FEATURE",
-	AUDIT_GRP_AUTH:                 "GRP_AUTH",
-	AUDIT_GRP_CHAUTHTOK:            "GRP_CHAUTHTOK",
-	AUDIT_GRP_MGMT:                 "GRP_MGMT",
-	AUDIT_INTEGRITY_DATA:           "INTEGRITY_DATA",
-	AUDIT_INTEGRITY_HASH:           "INTEGRITY_HASH",
-	AUDIT_INTEGRITY_LAST_MSG:       "INTEGRITY_LAST_MSG",
-	AUDIT_INTEGRITY_METADATA:       "INTEGRITY_METADATA",
-	AUDIT_INTEGRITY_PCR:            "INTEGRITY_PCR",
-	AUDIT_INTEGRITY_RULE:           "INTEGRITY_RULE",
-	AUDIT_INTEGRITY_STATUS:         "INTEGRITY_STATUS",
-	AUDIT_IPC:                      "IPC",
-	AUDIT_IPC_SET_PERM:             "IPC_SET_PERM",
-	AUDIT_KERNEL:                   "KERNEL",
-	AUDIT_KERNEL_OTHER:             "KERNEL_OTHER",
-	AUDIT_KERN_MODULE:              "KERN_MODULE",
-	AUDIT_LABEL_LEVEL_CHANGE:       "LABEL_LEVEL_CHANGE",
-	AUDIT_LABEL_OVERRIDE:           "LABEL_OVERRIDE",
-	AUDIT_LAST_ANOM_MSG:            "LAST_ANOM_MSG",
-	AUDIT_LAST_ANOM_RESP:           "LAST_ANOM_RESP",
-	AUDIT_LAST_APPARMOR:            "LAST_APPARMOR",
-	AUDIT_LAST_CRYPTO_MSG:          "LAST_CRYPTO_MSG",
-	AUDIT_LAST_DAEMON:              "LAST_DAEMON",
-	AUDIT_LAST_EVENT:               "LAST_EVENT",
-	AUDIT_LAST_KERN_ANOM_MSG:       "LAST_KERN_ANOM_MSG",
-	AUDIT_LAST_KERN_CRYPTO_MSG:     "LAST_KERN_CRYPTO_MSG",
-	AUDIT_LAST_SELINUX:             "LAST_SELINUX",
-	AUDIT_LAST_USER_LSPP_MSG:       "LAST_USER_LSPP_MSG",
-	AUDIT_LAST_USER_MSG:            "LAST_USER_MSG",
-	AUDIT_LAST_USER_MSG2:           "LAST_USER_MSG2",
-	AUDIT_LAST_VIRT_MSG:            "LAST_VIRT_MSG",
-	AUDIT_LIST:                     "LIST",
-	AUDIT_LIST_RULES:               "LIST_RULES",
-	AUDIT_LOGIN:                    "LOGIN",
-	AUDIT_MAC_CALIPSO_ADD:          "MAC_CALIPSO_ADD",
-	AUDIT_MAC_CALIPSO_DEL:          "MAC_CALIPSO_DEL",
-	AUDIT_MAC_CHECK:                "MAC_CHECK",
-	AUDIT_MAC_CIPSOV4_ADD:          "MAC_CIPSOV4_ADD",
-	AUDIT_MAC_CIPSOV4_DEL:          "MAC_CIPSOV4_DEL",
-	AUDIT_MAC_CONFIG_CHANGE:        "MAC_CONFIG_CHANGE",
-	AUDIT_MAC_IPSEC_ADDSA:          "MAC_IPSEC_ADDSA",
-	AUDIT_MAC_IPSEC_ADDSPD:         "MAC_IPSEC_ADDSPD",
-	AUDIT_MAC_IPSEC_DELSA:          "MAC_IPSEC_DELSA",
-	AUDIT_MAC_IPSEC_DELSPD:         "MAC_IPSEC_DELSPD",
-	AUDIT_MAC_IPSEC_EVENT:          "MAC_IPSEC_EVENT",
-	AUDIT_MAC_MAP_ADD:              "MAC_MAP_ADD",
-	AUDIT_MAC_MAP_DEL:              "MAC_MAP_DEL",
-	AUDIT_MAC_POLICY_LOAD:          "MAC_POLICY_LOAD",
-	AUDIT_MAC_STATUS:               "MAC_STATUS",
-	AUDIT_MAC_UNLBL_ALLOW:          "MAC_UNLBL_ALLOW",
-	AUDIT_MAC_UNLBL_STCADD:         "MAC_UNLBL_STCADD",
-	AUDIT_MAC_UNLBL_STCDEL:         "MAC_UNLBL_STCDEL",
-	AUDIT_MAKE_EQUIV:               "MAKE_EQUIV",
-	AUDIT_MMAP:                     "MMAP",
-	AUDIT_MQ_GETSETATTR:            "MQ_GETSETATTR",
-	AUDIT_MQ_NOTIFY:                "MQ_NOTIFY",
-	AUDIT_MQ_OPEN:                  "MQ_OPEN",
-	AUDIT_MQ_SENDRECV:              "MQ_SENDRECV",
-	AUDIT_NETFILTER_CFG:            "NETFILTER_CFG",
-	AUDIT_NETFILTER_PKT:            "NETFILTER_PKT",
-	AUDIT_OBJ_PID:                  "OBJ_PID",
-	AUDIT_PATH:                     "PATH",
-	AUDIT_PROCTITLE:                "PROCTITLE",
-	AUDIT_REPLACE:                  "REPLACE",
-	AUDIT_RESP_ACCT_LOCK:           "RESP_ACCT_LOCK",
-	AUDIT_RESP_ACCT_LOCK_TIMED:     "RESP_ACCT_LOCK_TIMED",
-	AUDIT_RESP_ACCT_REMOTE:         "RESP_ACCT_REMOTE",
-	AUDIT_RESP_ACCT_UNLOCK_TIMED:   "RESP_ACCT_UNLOCK_TIMED",
-	AUDIT_RESP_ALERT:               "RESP_ALERT",
-	AUDIT_RESP_ANOMALY:             "RESP_ANOMALY",
-	AUDIT_RESP_EXEC:                "RESP_EXEC",
-	AUDIT_RESP_HALT:                "RESP_HALT",
-	AUDIT_RESP_KILL_PROC:           "RESP_KILL_PROC",
-	AUDIT_RESP_ORIGIN_BLOCK:        "RESP_ORIGIN_BLOCK",
-	AUDIT_RESP_ORIGIN_BLOCK_TIMED:  "RESP_ORIGIN_BLOCK_TIMED",
-	AUDIT_RESP_SEBOOL:              "RESP_SEBOOL",
-	AUDIT_RESP_SINGLE:              "RESP_SINGLE",
-	AUDIT_RESP_TERM_ACCESS:         "RESP_TERM_ACCESS",
-	AUDIT_RESP_TERM_LOCK:           "RESP_TERM_LOCK",
-	AUDIT_ROLE_ASSIGN:              "ROLE_ASSIGN",
-	AUDIT_ROLE_MODIFY:              "ROLE_MODIFY",
-	AUDIT_ROLE_REMOVE:              "ROLE_REMOVE",
-	AUDIT_SECCOMP:                  "SECCOMP",
-	AUDIT_SELINUX_ERR:              "SELINUX_ERR",
-	AUDIT_SERVICE_START:            "SERVICE_START",
-	AUDIT_SERVICE_STOP:             "SERVICE_STOP",
-	AUDIT_SET:                      "SET",
-	AUDIT_SET_FEATURE:              "SET_FEATURE",
-	AUDIT_SIGNAL_INFO:              "SIGNAL_INFO",
-	AUDIT_SOCKADDR:                 "SOCKADDR",
-	AUDIT_SOCKETCALL:               "SOCKETCALL",
-	AUDIT_SOFTWARE_UPDATE:          "SOFTWARE_UPDATE",
-	AUDIT_SYSCALL:                  "SYSCALL",
-	AUDIT_SYSTEM_BOOT:              "SYSTEM_BOOT",
-	AUDIT_SYSTEM_RUNLEVEL:          "SYSTEM_RUNLEVEL",
-	AUDIT_SYSTEM_SHUTDOWN:          "SYSTEM_SHUTDOWN",
-	AUDIT_TEST:                     "TEST",
-	AUDIT_TRIM:                     "TRIM",
-	AUDIT_TRUSTED_APP:              "TRUSTED_APP",
-	AUDIT_TTY:                      "TTY",
-	AUDIT_TTY_GET:                  "TTY_GET",
-	AUDIT_TTY_SET:                  "TTY_SET",
-	AUDIT_USER:                     "USER",
-	AUDIT_USER_ACCT:                "USER_ACCT",
-	AUDIT_USER_AUTH:                "USER_AUTH",
-	AUDIT_USER_AVC:                 "USER_AVC",
-	AUDIT_USER_CHAUTHTOK:           "USER_CHAUTHTOK",
-	AUDIT_USER_CMD:                 "USER_CMD",
-	AUDIT_USER_DEVICE:              "USER_DEVICE",
-	AUDIT_USER_END:                 "USER_END",
-	AUDIT_USER_ERR:                 "USER_ERR",
-	AUDIT_USER_LABELED_EXPORT:      "USER_LABELED_EXPORT",
-	AUDIT_USER_LOGIN:               "USER_LOGIN",
-	AUDIT_USER_LOGOUT:              "USER_LOGOUT",
-	AUDIT_USER_MAC_CONFIG_CHANGE:   "USER_MAC_CONFIG_CHANGE",
-	AUDIT_USER_MAC_POLICY_LOAD:     "USER_MAC_POLICY_LOAD",
-	AUDIT_USER_MGMT:                "USER_MGMT",
-	AUDIT_USER_ROLE_CHANGE:         "USER_ROLE_CHANGE",
-	AUDIT_USER_SELINUX_ERR:         "USER_SELINUX_ERR",
-	AUDIT_USER_START:               "USER_START",
-	AUDIT_USER_TTY:                 "USER_TTY",
-	AUDIT_USER_UNLABELED_EXPORT:    "USER_UNLABELED_EXPORT",
-	AUDIT_USYS_CONFIG:              "USYS_CONFIG",
-	AUDIT_VIRT_CONTROL:             "VIRT_CONTROL",
-	AUDIT_VIRT_CREATE:              "VIRT_CREATE",
-	AUDIT_VIRT_DESTROY:             "VIRT_DESTROY",
-	AUDIT_VIRT_INTEGRITY_CHECK:     "VIRT_INTEGRITY_CHECK",
-	AUDIT_VIRT_MACHINE_ID:          "VIRT_MACHINE_ID",
-	AUDIT_VIRT_MIGRATE_IN:          "VIRT_MIGRATE_IN",
-	AUDIT_VIRT_MIGRATE_OUT:         "VIRT_MIGRATE_OUT",
-	AUDIT_VIRT_RESOURCE:            "VIRT_RESOURCE",
-	AUDIT_WATCH_INS:                "WATCH_INS",
-	AUDIT_WATCH_LIST:               "WATCH_LIST",
-	AUDIT_WATCH_REM:                "WATCH_REM",
+	AUDIT_AA:                        "APPARMOR",
+	AUDIT_ACCT_LOCK:                 "ACCT_LOCK",
+	AUDIT_ACCT_UNLOCK:               "ACCT_UNLOCK",
+	AUDIT_ADD:                       "ADD",
+	AUDIT_ADD_GROUP:                 "ADD_GROUP",
+	AUDIT_ADD_RULE:                  "ADD_RULE",
+	AUDIT_ADD_USER:                  "ADD_USER",
+	AUDIT_ANOM_ABEND:                "ANOM_ABEND",
+	AUDIT_ANOM_ACCESS_FS:            "ANOM_ACCESS_FS",
+	AUDIT_ANOM_ADD_ACCT:             "ANOM_ADD_ACCT",
+	AUDIT_ANOM_AMTU_FAIL:            "ANOM_AMTU_FAIL",
+	AUDIT_ANOM_CREAT:                "ANOM_CREAT",
+	AUDIT_ANOM_CRYPTO_FAIL:          "ANOM_CRYPTO_FAIL",
+	AUDIT_ANOM_DEL_ACCT:             "ANOM_DEL_ACCT",
+	AUDIT_ANOM_EXEC:                 "ANOM_EXEC",
+	AUDIT_ANOM_LINK:                 "ANOM_LINK",
+	AUDIT_ANOM_LOGIN_ACCT:           "ANOM_LOGIN_ACCT",
+	AUDIT_ANOM_LOGIN_FAILURES:       "ANOM_LOGIN_FAILURES",
+	AUDIT_ANOM_LOGIN_LOCATION:       "ANOM_LOGIN_LOCATION",
+	AUDIT_ANOM_LOGIN_ROOT:           "ANOM_LOGIN_ROOT",
+	AUDIT_ANOM_LOGIN_SERVICE:        "ANOM_LOGIN_SERVICE",
+	AUDIT_ANOM_LOGIN_SESSIONS:       "ANOM_LOGIN_SESSIONS",
+	AUDIT_ANOM_LOGIN_TIME:           "ANOM_LOGIN_TIME",
+	AUDIT_ANOM_MAX_DAC:              "ANOM_MAX_DAC",
+	AUDIT_ANOM_MAX_MAC:              "ANOM_MAX_MAC",
+	AUDIT_ANOM_MK_EXEC:              "ANOM_MK_EXEC",
+	AUDIT_ANOM_MOD_ACCT:             "ANOM_MOD_ACCT",
+	AUDIT_ANOM_ORIGIN_FAILURES:      "ANOM_ORIGIN_FAILURES",
+	AUDIT_ANOM_PROMISCUOUS:          "ANOM_PROMISCUOUS",
+	AUDIT_ANOM_RBAC_FAIL:            "ANOM_RBAC_FAIL",
+	AUDIT_ANOM_RBAC_INTEGRITY_FAIL:  "ANOM_RBAC_INTEGRITY_FAIL",
+	AUDIT_ANOM_ROOT_TRANS:           "ANOM_ROOT_TRANS",
+	AUDIT_ANOM_SESSION:              "ANOM_SESSION",
+	AUDIT_APPARMOR_ALLOWED:          "APPARMOR_ALLOWED",
+	AUDIT_APPARMOR_AUDIT:            "APPARMOR_AUDIT",
+	AUDIT_APPARMOR_DENIED:           "APPARMOR_DENIED",
+	AUDIT_APPARMOR_ERROR:            "APPARMOR_ERROR",
+	AUDIT_APPARMOR_HINT:             "APPARMOR_HINT",
+	AUDIT_APPARMOR_KILL:             "APPARMOR_KILL",
+	AUDIT_APPARMOR_STATUS:           "APPARMOR_STATUS",
+	AUDIT_AVC:                       "AVC",
+	AUDIT_AVC_PATH:                  "AVC_PATH",
+	AUDIT_BPF:                       "BPF",
+	AUDIT_BPRM_FCAPS:                "BPRM_FCAPS",
+	AUDIT_CAPSET:                    "CAPSET",
+	AUDIT_CHGRP_ID:                  "CHGRP_ID",
+	AUDIT_CHUSER_ID:                 "CHUSER_ID",
+	AUDIT_CONFIG_CHANGE:             "CONFIG_CHANGE",
+	AUDIT_CRED_ACQ:                  "CRED_ACQ",
+	AUDIT_CRED_DISP:                 "CRED_DISP",
+	AUDIT_CRED_REFR:                 "CRED_REFR",
+	AUDIT_CRYPTO_FAILURE_USER:       "CRYPTO_FAILURE_USER",
+	AUDIT_CRYPTO_IKE_SA:             "CRYPTO_IKE_SA",
+	AUDIT_CRYPTO_IPSEC_SA:           "CRYPTO_IPSEC_SA",
+	AUDIT_CRYPTO_KEY_USER:           "CRYPTO_KEY_USER",
+	AUDIT_CRYPTO_LOGIN:              "CRYPTO_LOGIN",
+	AUDIT_CRYPTO_LOGOUT:             "CRYPTO_LOGOUT",
+	AUDIT_CRYPTO_PARAM_CHANGE_USER:  "CRYPTO_PARAM_CHANGE_USER",
+	AUDIT_CRYPTO_REPLAY_USER:        "CRYPTO_REPLAY_USER",
+	AUDIT_CRYPTO_SESSION:            "CRYPTO_SESSION",
+	AUDIT_CRYPTO_TEST_USER:          "CRYPTO_TEST_USER",
+	AUDIT_CWD:                       "CWD",
+	AUDIT_DAC_CHECK:                 "DAC_CHECK",
+	AUDIT_DAEMON_ABORT:              "DAEMON_ABORT",
+	AUDIT_DAEMON_ACCEPT:             "DAEMON_ACCEPT",
+	AUDIT_DAEMON_CLOSE:              "DAEMON_CLOSE",
+	AUDIT_DAEMON_CONFIG:             "DAEMON_CONFIG",
+	AUDIT_DAEMON_END:                "DAEMON_END",
+	AUDIT_DAEMON_ERR:                "DAEMON_ERR",
+	AUDIT_DAEMON_RECONFIG:           "DAEMON_RECONFIG",
+	AUDIT_DAEMON_RESUME:             "DAEMON_RESUME",
+	AUDIT_DAEMON_ROTATE:             "DAEMON_ROTATE",
+	AUDIT_DAEMON_START:              "DAEMON_START",
+	AUDIT_DEL:                       "DEL",
+	AUDIT_DEL_GROUP:                 "DEL_GROUP",
+	AUDIT_DEL_RULE:                  "DEL_RULE",
+	AUDIT_DEL_USER:                  "DEL_USER",
+	AUDIT_DEV_ALLOC:                 "DEV_ALLOC",
+	AUDIT_DEV_DEALLOC:               "DEV_DEALLOC",
+	AUDIT_DM_CTRL:                   "DM_CTRL",
+	AUDIT_DM_EVENT:                  "DM_EVENT",
+	AUDIT_EOE:                       "EOE",
+	AUDIT_EVENT_LISTENER:            "EVENT_LISTENER",
+	AUDIT_EXECVE:                    "EXECVE",
+	AUDIT_FANOTIFY:                  "FANOTIFY",
+	AUDIT_FD_PAIR:                   "FD_PAIR",
+	AUDIT_FEATURE_CHANGE:            "FEATURE_CHANGE",
+	AUDIT_FIRST_KERN_CRYPTO_MSG:     "FIRST_KERN_CRYPTO_MSG",
+	AUDIT_FS_RELABEL:                "FS_RELABEL",
+	AUDIT_GET:                       "GET",
+	AUDIT_GET_FEATURE:               "GET_FEATURE",
+	AUDIT_GRP_AUTH:                  "GRP_AUTH",
+	AUDIT_GRP_CHAUTHTOK:             "GRP_CHAUTHTOK",
+	AUDIT_GRP_MGMT:                  "GRP_MGMT",
+	AUDIT_INTEGRITY_DATA:            "INTEGRITY_DATA",
+	AUDIT_INTEGRITY_EVM_XATTR:       "INTEGRITY_EVM_XATTR",
+	AUDIT_INTEGRITY_HASH:            "INTEGRITY_HASH",
+	AUDIT_INTEGRITY_LAST_MSG:        "INTEGRITY_LAST_MSG",
+	AUDIT_INTEGRITY_METADATA:        "INTEGRITY_METADATA",
+	AUDIT_INTEGRITY_PCR:             "INTEGRITY_PCR",
+	AUDIT_INTEGRITY_POLICY_RULE:     "INTEGRITY_POLICY_RULE",
+	AUDIT_INTEGRITY_RULE:            "INTEGRITY_RULE",
+	AUDIT_INTEGRITY_STATUS:          "INTEGRITY_STATUS",
+	AUDIT_IPC:                       "IPC",
+	AUDIT_IPC_SET_PERM:              "IPC_SET_PERM",
+	AUDIT_KERNEL:                    "KERNEL",
+	AUDIT_KERNEL_OTHER:              "KERNEL_OTHER",
+	AUDIT_KERN_MODULE:               "KERN_MODULE",
+	AUDIT_LABEL_LEVEL_CHANGE:        "LABEL_LEVEL_CHANGE",
+	AUDIT_LABEL_OVERRIDE:            "LABEL_OVERRIDE",
+	AUDIT_LAST_ANOM_MSG:             "LAST_ANOM_MSG",
+	AUDIT_LAST_ANOM_RESP:            "LAST_ANOM_RESP",
+	AUDIT_LAST_APPARMOR:             "LAST_APPARMOR",
+	AUDIT_LAST_CRYPTO_MSG:           "LAST_CRYPTO_MSG",
+	AUDIT_LAST_DAEMON:               "LAST_DAEMON",
+	AUDIT_LAST_EVENT:                "LAST_EVENT",
+	AUDIT_LAST_KERN_ANOM_MSG:        "LAST_KERN_ANOM_MSG",
+	AUDIT_LAST_KERN_CRYPTO_MSG:      "LAST_KERN_CRYPTO_MSG",
+	AUDIT_LAST_SELINUX:              "LAST_SELINUX",
+	AUDIT_LAST_USER_LSPP_MSG:        "LAST_USER_LSPP_MSG",
+	AUDIT_LAST_USER_MSG:             "LAST_USER_MSG",
+	AUDIT_LAST_USER_MSG2:            "LAST_USER_MSG2",
+	AUDIT_LAST_VIRT_MSG:             "LAST_VIRT_MSG",
+	AUDIT_LIST:                      "LIST",
+	AUDIT_LIST_RULES:                "LIST_RULES",
+	AUDIT_LOGIN:                     "LOGIN",
+	AUDIT_MAC_CALIPSO_ADD:           "MAC_CALIPSO_ADD",
+	AUDIT_MAC_CALIPSO_DEL:           "MAC_CALIPSO_DEL",
+	AUDIT_MAC_CHECK:                 "MAC_CHECK",
+	AUDIT_MAC_CIPSOV4_ADD:           "MAC_CIPSOV4_ADD",
+	AUDIT_MAC_CIPSOV4_DEL:           "MAC_CIPSOV4_DEL",
+	AUDIT_MAC_CONFIG_CHANGE:         "MAC_CONFIG_CHANGE",
+	AUDIT_MAC_IPSEC_ADDSA:           "MAC_IPSEC_ADDSA",
+	AUDIT_MAC_IPSEC_ADDSPD:          "MAC_IPSEC_ADDSPD",
+	AUDIT_MAC_IPSEC_DELSA:           "MAC_IPSEC_DELSA",
+	AUDIT_MAC_IPSEC_DELSPD:          "MAC_IPSEC_DELSPD",
+	AUDIT_MAC_IPSEC_EVENT:           "MAC_IPSEC_EVENT",
+	AUDIT_MAC_MAP_ADD:               "MAC_MAP_ADD",
+	AUDIT_MAC_MAP_DEL:               "MAC_MAP_DEL",
+	AUDIT_MAC_POLICY_LOAD:           "MAC_POLICY_LOAD",
+	AUDIT_MAC_STATUS:                "MAC_STATUS",
+	AUDIT_MAC_UNLBL_ALLOW:           "MAC_UNLBL_ALLOW",
+	AUDIT_MAC_UNLBL_STCADD:          "MAC_UNLBL_STCADD",
+	AUDIT_MAC_UNLBL_STCDEL:          "MAC_UNLBL_STCDEL",
+	AUDIT_MAKE_EQUIV:                "MAKE_EQUIV",
+	AUDIT_MMAP:                      "MMAP",
+	AUDIT_MQ_GETSETATTR:             "MQ_GETSETATTR",
+	AUDIT_MQ_NOTIFY:                 "MQ_NOTIFY",
+	AUDIT_MQ_OPEN:                   "MQ_OPEN",
+	AUDIT_MQ_SENDRECV:               "MQ_SENDRECV",
+	AUDIT_NETFILTER_CFG:             "NETFILTER_CFG",
+	AUDIT_NETFILTER_PKT:             "NETFILTER_PKT",
+	AUDIT_OBJ_PID:                   "OBJ_PID",
+	AUDIT_OPENAT2:                   "OPENAT2",
+	AUDIT_PATH:                      "PATH",
+	AUDIT_PROCTITLE:                 "PROCTITLE",
+	AUDIT_REPLACE:                   "REPLACE",
+	AUDIT_RESP_ACCT_LOCK:            "RESP_ACCT_LOCK",
+	AUDIT_RESP_ACCT_LOCK_TIMED:      "RESP_ACCT_LOCK_TIMED",
+	AUDIT_RESP_ACCT_REMOTE:          "RESP_ACCT_REMOTE",
+	AUDIT_RESP_ACCT_UNLOCK_TIMED:    "RESP_ACCT_UNLOCK_TIMED",
+	AUDIT_RESP_ALERT:                "RESP_ALERT",
+	AUDIT_RESP_ANOMALY:              "RESP_ANOMALY",
+	AUDIT_RESP_EXEC:                 "RESP_EXEC",
+	AUDIT_RESP_HALT:                 "RESP_HALT",
+	AUDIT_RESP_KILL_PROC:            "RESP_KILL_PROC",
+	AUDIT_RESP_ORIGIN_BLOCK:         "RESP_ORIGIN_BLOCK",
+	AUDIT_RESP_ORIGIN_BLOCK_TIMED:   "RESP_ORIGIN_BLOCK_TIMED",
+	AUDIT_RESP_ORIGIN_UNBLOCK_TIMED: "RESP_ORIGIN_UNBLOCK_TIMED",
+	AUDIT_RESP_SEBOOL:               "RESP_SEBOOL",
+	AUDIT_RESP_SINGLE:               "RESP_SINGLE",
+	AUDIT_RESP_TERM_ACCESS:          "RESP_TERM_ACCESS",
+	AUDIT_RESP_TERM_LOCK:            "RESP_TERM_LOCK",
+	AUDIT_ROLE_ASSIGN:               "ROLE_ASSIGN",
+	AUDIT_ROLE_MODIFY:               "ROLE_MODIFY",
+	AUDIT_ROLE_REMOVE:               "ROLE_REMOVE",
+	AUDIT_SECCOMP:                   "SECCOMP",
+	AUDIT_SELINUX_ERR:               "SELINUX_ERR",
+	AUDIT_SERVICE_START:             "SERVICE_START",
+	AUDIT_SERVICE_STOP:              "SERVICE_STOP",
+	AUDIT_SET:                       "SET",
+	AUDIT_SET_FEATURE:               "SET_FEATURE",
+	AUDIT_SIGNAL_INFO:               "SIGNAL_INFO",
+	AUDIT_SOCKADDR:                  "SOCKADDR",
+	AUDIT_SOCKETCALL:                "SOCKETCALL",
+	AUDIT_SOFTWARE_UPDATE:           "SOFTWARE_UPDATE",
+	AUDIT_SYSCALL:                   "SYSCALL",
+	AUDIT_SYSTEM_BOOT:               "SYSTEM_BOOT",
+	AUDIT_SYSTEM_RUNLEVEL:           "SYSTEM_RUNLEVEL",
+	AUDIT_SYSTEM_SHUTDOWN:           "SYSTEM_SHUTDOWN",
+	AUDIT_TEST:                      "TEST",
+	AUDIT_TIME_ADJNTPVAL:            "TIME_ADJNTPVAL",
+	AUDIT_TIME_INJOFFSET:            "TIME_INJOFFSET",
+	AUDIT_TRIM:                      "TRIM",
+	AUDIT_TRUSTED_APP:               "TRUSTED_APP",
+	AUDIT_TTY:                       "TTY",
+	AUDIT_TTY_GET:                   "TTY_GET",
+	AUDIT_TTY_SET:                   "TTY_SET",
+	AUDIT_URINGOP:                   "URINGOP",
+	AUDIT_USER:                      "USER",
+	AUDIT_USER_ACCT:                 "USER_ACCT",
+	AUDIT_USER_AUTH:                 "USER_AUTH",
+	AUDIT_USER_AVC:                  "USER_AVC",
+	AUDIT_USER_CHAUTHTOK:            "USER_CHAUTHTOK",
+	AUDIT_USER_CMD:                  "USER_CMD",
+	AUDIT_USER_DEVICE:               "USER_DEVICE",
+	AUDIT_USER_END:                  "USER_END",
+	AUDIT_USER_ERR:                  "USER_ERR",
+	AUDIT_USER_LABELED_EXPORT:       "USER_LABELED_EXPORT",
+	AUDIT_USER_LOGIN:                "USER_LOGIN",
+	AUDIT_USER_LOGOUT:               "USER_LOGOUT",
+	AUDIT_USER_MAC_CONFIG_CHANGE:    "USER_MAC_CONFIG_CHANGE",
+	AUDIT_USER_MAC_POLICY_LOAD:      "USER_MAC_POLICY_LOAD",
+	AUDIT_USER_MAC_STATUS:           "USER_MAC_STATUS",
+	AUDIT_USER_MGMT:                 "USER_MGMT",
+	AUDIT_USER_ROLE_CHANGE:          "USER_ROLE_CHANGE",
+	AUDIT_USER_SELINUX_ERR:          "USER_SELINUX_ERR",
+	AUDIT_USER_START:                "USER_START",
+	AUDIT_USER_TTY:                  "USER_TTY",
+	AUDIT_USER_UNLABELED_EXPORT:     "USER_UNLABELED_EXPORT",
+	AUDIT_USYS_CONFIG:               "USYS_CONFIG",
+	AUDIT_VIRT_CONTROL:              "VIRT_CONTROL",
+	AUDIT_VIRT_CREATE:               "VIRT_CREATE",
+	AUDIT_VIRT_DESTROY:              "VIRT_DESTROY",
+	AUDIT_VIRT_INTEGRITY_CHECK:      "VIRT_INTEGRITY_CHECK",
+	AUDIT_VIRT_MACHINE_ID:           "VIRT_MACHINE_ID",
+	AUDIT_VIRT_MIGRATE_IN:           "VIRT_MIGRATE_IN",
+	AUDIT_VIRT_MIGRATE_OUT:          "VIRT_MIGRATE_OUT",
+	AUDIT_VIRT_RESOURCE:             "VIRT_RESOURCE",
+	AUDIT_WATCH_INS:                 "WATCH_INS",
+	AUDIT_WATCH_LIST:                "WATCH_LIST",
+	AUDIT_WATCH_REM:                 "WATCH_REM",
 }
 
 func (t AuditMessageType) String() string {
@@ -491,221 +525,238 @@ func (t *AuditMessageType) UnmarshalText(text []byte) error {
 }
 
 var auditMessageNameToType = map[string]AuditMessageType{
-	"APPARMOR":                 AUDIT_AA,
-	"ACCT_LOCK":                AUDIT_ACCT_LOCK,
-	"ACCT_UNLOCK":              AUDIT_ACCT_UNLOCK,
-	"ADD":                      AUDIT_ADD,
-	"ADD_GROUP":                AUDIT_ADD_GROUP,
-	"ADD_RULE":                 AUDIT_ADD_RULE,
-	"ADD_USER":                 AUDIT_ADD_USER,
-	"ANOM_ABEND":               AUDIT_ANOM_ABEND,
-	"ANOM_ACCESS_FS":           AUDIT_ANOM_ACCESS_FS,
-	"ANOM_ADD_ACCT":            AUDIT_ANOM_ADD_ACCT,
-	"ANOM_AMTU_FAIL":           AUDIT_ANOM_AMTU_FAIL,
-	"ANOM_CRYPTO_FAIL":         AUDIT_ANOM_CRYPTO_FAIL,
-	"ANOM_DEL_ACCT":            AUDIT_ANOM_DEL_ACCT,
-	"ANOM_EXEC":                AUDIT_ANOM_EXEC,
-	"ANOM_LINK":                AUDIT_ANOM_LINK,
-	"ANOM_LOGIN_ACCT":          AUDIT_ANOM_LOGIN_ACCT,
-	"ANOM_LOGIN_FAILURES":      AUDIT_ANOM_LOGIN_FAILURES,
-	"ANOM_LOGIN_LOCATION":      AUDIT_ANOM_LOGIN_LOCATION,
-	"ANOM_LOGIN_SERVICE":       AUDIT_ANOM_LOGIN_SERVICE,
-	"ANOM_LOGIN_SESSIONS":      AUDIT_ANOM_LOGIN_SESSIONS,
-	"ANOM_LOGIN_TIME":          AUDIT_ANOM_LOGIN_TIME,
-	"ANOM_MAX_DAC":             AUDIT_ANOM_MAX_DAC,
-	"ANOM_MAX_MAC":             AUDIT_ANOM_MAX_MAC,
-	"ANOM_MK_EXEC":             AUDIT_ANOM_MK_EXEC,
-	"ANOM_MOD_ACCT":            AUDIT_ANOM_MOD_ACCT,
-	"ANOM_PROMISCUOUS":         AUDIT_ANOM_PROMISCUOUS,
-	"ANOM_RBAC_FAIL":           AUDIT_ANOM_RBAC_FAIL,
-	"ANOM_RBAC_INTEGRITY_FAIL": AUDIT_ANOM_RBAC_INTEGRITY_FAIL,
-	"ANOM_ROOT_TRANS":          AUDIT_ANOM_ROOT_TRANS,
-	"APPARMOR_ALLOWED":         AUDIT_APPARMOR_ALLOWED,
-	"APPARMOR_AUDIT":           AUDIT_APPARMOR_AUDIT,
-	"APPARMOR_DENIED":          AUDIT_APPARMOR_DENIED,
-	"APPARMOR_ERROR":           AUDIT_APPARMOR_ERROR,
-	"APPARMOR_HINT":            AUDIT_APPARMOR_HINT,
-	"APPARMOR_STATUS":          AUDIT_APPARMOR_STATUS,
-	"AVC":                      AUDIT_AVC,
-	"AVC_PATH":                 AUDIT_AVC_PATH,
-	"BPRM_FCAPS":               AUDIT_BPRM_FCAPS,
-	"CAPSET":                   AUDIT_CAPSET,
-	"CHGRP_ID":                 AUDIT_CHGRP_ID,
-	"CHUSER_ID":                AUDIT_CHUSER_ID,
-	"CONFIG_CHANGE":            AUDIT_CONFIG_CHANGE,
-	"CRED_ACQ":                 AUDIT_CRED_ACQ,
-	"CRED_DISP":                AUDIT_CRED_DISP,
-	"CRED_REFR":                AUDIT_CRED_REFR,
-	"CRYPTO_FAILURE_USER":      AUDIT_CRYPTO_FAILURE_USER,
-	"CRYPTO_IKE_SA":            AUDIT_CRYPTO_IKE_SA,
-	"CRYPTO_IPSEC_SA":          AUDIT_CRYPTO_IPSEC_SA,
-	"CRYPTO_KEY_USER":          AUDIT_CRYPTO_KEY_USER,
-	"CRYPTO_LOGIN":             AUDIT_CRYPTO_LOGIN,
-	"CRYPTO_LOGOUT":            AUDIT_CRYPTO_LOGOUT,
-	"CRYPTO_PARAM_CHANGE_USER": AUDIT_CRYPTO_PARAM_CHANGE_USER,
-	"CRYPTO_REPLAY_USER":       AUDIT_CRYPTO_REPLAY_USER,
-	"CRYPTO_SESSION":           AUDIT_CRYPTO_SESSION,
-	"CRYPTO_TEST_USER":         AUDIT_CRYPTO_TEST_USER,
-	"CWD":                      AUDIT_CWD,
-	"DAC_CHECK":                AUDIT_DAC_CHECK,
-	"DAEMON_ABORT":             AUDIT_DAEMON_ABORT,
-	"DAEMON_ACCEPT":            AUDIT_DAEMON_ACCEPT,
-	"DAEMON_CLOSE":             AUDIT_DAEMON_CLOSE,
-	"DAEMON_CONFIG":            AUDIT_DAEMON_CONFIG,
-	"DAEMON_END":               AUDIT_DAEMON_END,
-	"DAEMON_ERR":               AUDIT_DAEMON_ERR,
-	"DAEMON_RECONFIG":          AUDIT_DAEMON_RECONFIG,
-	"DAEMON_RESUME":            AUDIT_DAEMON_RESUME,
-	"DAEMON_ROTATE":            AUDIT_DAEMON_ROTATE,
-	"DAEMON_START":             AUDIT_DAEMON_START,
-	"DEL":                      AUDIT_DEL,
-	"DEL_GROUP":                AUDIT_DEL_GROUP,
-	"DEL_RULE":                 AUDIT_DEL_RULE,
-	"DEL_USER":                 AUDIT_DEL_USER,
-	"DEV_ALLOC":                AUDIT_DEV_ALLOC,
-	"DEV_DEALLOC":              AUDIT_DEV_DEALLOC,
-	"EOE":                      AUDIT_EOE,
-	"EXECVE":                   AUDIT_EXECVE,
-	"FANOTIFY":                 AUDIT_FANOTIFY,
-	"FD_PAIR":                  AUDIT_FD_PAIR,
-	"FEATURE_CHANGE":           AUDIT_FEATURE_CHANGE,
-	"FIRST_KERN_CRYPTO_MSG":    AUDIT_FIRST_KERN_CRYPTO_MSG,
-	"FS_RELABEL":               AUDIT_FS_RELABEL,
-	"GET":                      AUDIT_GET,
-	"GET_FEATURE":              AUDIT_GET_FEATURE,
-	"GRP_AUTH":                 AUDIT_GRP_AUTH,
-	"GRP_CHAUTHTOK":            AUDIT_GRP_CHAUTHTOK,
-	"GRP_MGMT":                 AUDIT_GRP_MGMT,
-	"INTEGRITY_DATA":           AUDIT_INTEGRITY_DATA,
-	"INTEGRITY_HASH":           AUDIT_INTEGRITY_HASH,
-	"INTEGRITY_LAST_MSG":       AUDIT_INTEGRITY_LAST_MSG,
-	"INTEGRITY_METADATA":       AUDIT_INTEGRITY_METADATA,
-	"INTEGRITY_PCR":            AUDIT_INTEGRITY_PCR,
-	"INTEGRITY_RULE":           AUDIT_INTEGRITY_RULE,
-	"INTEGRITY_STATUS":         AUDIT_INTEGRITY_STATUS,
-	"IPC":                      AUDIT_IPC,
-	"IPC_SET_PERM":             AUDIT_IPC_SET_PERM,
-	"KERNEL":                   AUDIT_KERNEL,
-	"KERNEL_OTHER":             AUDIT_KERNEL_OTHER,
-	"KERN_MODULE":              AUDIT_KERN_MODULE,
-	"LABEL_LEVEL_CHANGE":       AUDIT_LABEL_LEVEL_CHANGE,
-	"LABEL_OVERRIDE":           AUDIT_LABEL_OVERRIDE,
-	"LAST_ANOM_MSG":            AUDIT_LAST_ANOM_MSG,
-	"LAST_ANOM_RESP":           AUDIT_LAST_ANOM_RESP,
-	"LAST_APPARMOR":            AUDIT_LAST_APPARMOR,
-	"LAST_CRYPTO_MSG":          AUDIT_LAST_CRYPTO_MSG,
-	"LAST_DAEMON":              AUDIT_LAST_DAEMON,
-	"LAST_EVENT":               AUDIT_LAST_EVENT,
-	"LAST_KERN_ANOM_MSG":       AUDIT_LAST_KERN_ANOM_MSG,
-	"LAST_KERN_CRYPTO_MSG":     AUDIT_LAST_KERN_CRYPTO_MSG,
-	"LAST_SELINUX":             AUDIT_LAST_SELINUX,
-	"LAST_USER_LSPP_MSG":       AUDIT_LAST_USER_LSPP_MSG,
-	"LAST_USER_MSG":            AUDIT_LAST_USER_MSG,
-	"LAST_USER_MSG2":           AUDIT_LAST_USER_MSG2,
-	"LAST_VIRT_MSG":            AUDIT_LAST_VIRT_MSG,
-	"LIST":                     AUDIT_LIST,
-	"LIST_RULES":               AUDIT_LIST_RULES,
-	"LOGIN":                    AUDIT_LOGIN,
-	"MAC_CALIPSO_ADD":          AUDIT_MAC_CALIPSO_ADD,
-	"MAC_CALIPSO_DEL":          AUDIT_MAC_CALIPSO_DEL,
-	"MAC_CHECK":                AUDIT_MAC_CHECK,
-	"MAC_CIPSOV4_ADD":          AUDIT_MAC_CIPSOV4_ADD,
-	"MAC_CIPSOV4_DEL":          AUDIT_MAC_CIPSOV4_DEL,
-	"MAC_CONFIG_CHANGE":        AUDIT_MAC_CONFIG_CHANGE,
-	"MAC_IPSEC_ADDSA":          AUDIT_MAC_IPSEC_ADDSA,
-	"MAC_IPSEC_ADDSPD":         AUDIT_MAC_IPSEC_ADDSPD,
-	"MAC_IPSEC_DELSA":          AUDIT_MAC_IPSEC_DELSA,
-	"MAC_IPSEC_DELSPD":         AUDIT_MAC_IPSEC_DELSPD,
-	"MAC_IPSEC_EVENT":          AUDIT_MAC_IPSEC_EVENT,
-	"MAC_MAP_ADD":              AUDIT_MAC_MAP_ADD,
-	"MAC_MAP_DEL":              AUDIT_MAC_MAP_DEL,
-	"MAC_POLICY_LOAD":          AUDIT_MAC_POLICY_LOAD,
-	"MAC_STATUS":               AUDIT_MAC_STATUS,
-	"MAC_UNLBL_ALLOW":          AUDIT_MAC_UNLBL_ALLOW,
-	"MAC_UNLBL_STCADD":         AUDIT_MAC_UNLBL_STCADD,
-	"MAC_UNLBL_STCDEL":         AUDIT_MAC_UNLBL_STCDEL,
-	"MAKE_EQUIV":               AUDIT_MAKE_EQUIV,
-	"MMAP":                     AUDIT_MMAP,
-	"MQ_GETSETATTR":            AUDIT_MQ_GETSETATTR,
-	"MQ_NOTIFY":                AUDIT_MQ_NOTIFY,
-	"MQ_OPEN":                  AUDIT_MQ_OPEN,
-	"MQ_SENDRECV":              AUDIT_MQ_SENDRECV,
-	"NETFILTER_CFG":            AUDIT_NETFILTER_CFG,
-	"NETFILTER_PKT":            AUDIT_NETFILTER_PKT,
-	"OBJ_PID":                  AUDIT_OBJ_PID,
-	"PATH":                     AUDIT_PATH,
-	"PROCTITLE":                AUDIT_PROCTITLE,
-	"REPLACE":                  AUDIT_REPLACE,
-	"RESP_ACCT_LOCK":           AUDIT_RESP_ACCT_LOCK,
-	"RESP_ACCT_LOCK_TIMED":     AUDIT_RESP_ACCT_LOCK_TIMED,
-	"RESP_ACCT_REMOTE":         AUDIT_RESP_ACCT_REMOTE,
-	"RESP_ACCT_UNLOCK_TIMED":   AUDIT_RESP_ACCT_UNLOCK_TIMED,
-	"RESP_ALERT":               AUDIT_RESP_ALERT,
-	"RESP_ANOMALY":             AUDIT_RESP_ANOMALY,
-	"RESP_EXEC":                AUDIT_RESP_EXEC,
-	"RESP_HALT":                AUDIT_RESP_HALT,
-	"RESP_KILL_PROC":           AUDIT_RESP_KILL_PROC,
-	"RESP_ORIGIN_BLOCK":        AUDIT_RESP_ORIGIN_BLOCK,
-	"RESP_ORIGIN_BLOCK_TIMED":  AUDIT_RESP_ORIGIN_BLOCK_TIMED,
-	"RESP_SEBOOL":              AUDIT_RESP_SEBOOL,
-	"RESP_SINGLE":              AUDIT_RESP_SINGLE,
-	"RESP_TERM_ACCESS":         AUDIT_RESP_TERM_ACCESS,
-	"RESP_TERM_LOCK":           AUDIT_RESP_TERM_LOCK,
-	"ROLE_ASSIGN":              AUDIT_ROLE_ASSIGN,
-	"ROLE_MODIFY":              AUDIT_ROLE_MODIFY,
-	"ROLE_REMOVE":              AUDIT_ROLE_REMOVE,
-	"SECCOMP":                  AUDIT_SECCOMP,
-	"SELINUX_ERR":              AUDIT_SELINUX_ERR,
-	"SERVICE_START":            AUDIT_SERVICE_START,
-	"SERVICE_STOP":             AUDIT_SERVICE_STOP,
-	"SET":                      AUDIT_SET,
-	"SET_FEATURE":              AUDIT_SET_FEATURE,
-	"SIGNAL_INFO":              AUDIT_SIGNAL_INFO,
-	"SOCKADDR":                 AUDIT_SOCKADDR,
-	"SOCKETCALL":               AUDIT_SOCKETCALL,
-	"SOFTWARE_UPDATE":          AUDIT_SOFTWARE_UPDATE,
-	"SYSCALL":                  AUDIT_SYSCALL,
-	"SYSTEM_BOOT":              AUDIT_SYSTEM_BOOT,
-	"SYSTEM_RUNLEVEL":          AUDIT_SYSTEM_RUNLEVEL,
-	"SYSTEM_SHUTDOWN":          AUDIT_SYSTEM_SHUTDOWN,
-	"TEST":                     AUDIT_TEST,
-	"TRIM":                     AUDIT_TRIM,
-	"TRUSTED_APP":              AUDIT_TRUSTED_APP,
-	"TTY":                      AUDIT_TTY,
-	"TTY_GET":                  AUDIT_TTY_GET,
-	"TTY_SET":                  AUDIT_TTY_SET,
-	"USER":                     AUDIT_USER,
-	"USER_ACCT":                AUDIT_USER_ACCT,
-	"USER_AUTH":                AUDIT_USER_AUTH,
-	"USER_AVC":                 AUDIT_USER_AVC,
-	"USER_CHAUTHTOK":           AUDIT_USER_CHAUTHTOK,
-	"USER_CMD":                 AUDIT_USER_CMD,
-	"USER_DEVICE":              AUDIT_USER_DEVICE,
-	"USER_END":                 AUDIT_USER_END,
-	"USER_ERR":                 AUDIT_USER_ERR,
-	"USER_LABELED_EXPORT":      AUDIT_USER_LABELED_EXPORT,
-	"USER_LOGIN":               AUDIT_USER_LOGIN,
-	"USER_LOGOUT":              AUDIT_USER_LOGOUT,
-	"USER_MAC_CONFIG_CHANGE":   AUDIT_USER_MAC_CONFIG_CHANGE,
-	"USER_MAC_POLICY_LOAD":     AUDIT_USER_MAC_POLICY_LOAD,
-	"USER_MGMT":                AUDIT_USER_MGMT,
-	"USER_ROLE_CHANGE":         AUDIT_USER_ROLE_CHANGE,
-	"USER_SELINUX_ERR":         AUDIT_USER_SELINUX_ERR,
-	"USER_START":               AUDIT_USER_START,
-	"USER_TTY":                 AUDIT_USER_TTY,
-	"USER_UNLABELED_EXPORT":    AUDIT_USER_UNLABELED_EXPORT,
-	"USYS_CONFIG":              AUDIT_USYS_CONFIG,
-	"VIRT_CONTROL":             AUDIT_VIRT_CONTROL,
-	"VIRT_CREATE":              AUDIT_VIRT_CREATE,
-	"VIRT_DESTROY":             AUDIT_VIRT_DESTROY,
-	"VIRT_INTEGRITY_CHECK":     AUDIT_VIRT_INTEGRITY_CHECK,
-	"VIRT_MACHINE_ID":          AUDIT_VIRT_MACHINE_ID,
-	"VIRT_MIGRATE_IN":          AUDIT_VIRT_MIGRATE_IN,
-	"VIRT_MIGRATE_OUT":         AUDIT_VIRT_MIGRATE_OUT,
-	"VIRT_RESOURCE":            AUDIT_VIRT_RESOURCE,
-	"WATCH_INS":                AUDIT_WATCH_INS,
-	"WATCH_LIST":               AUDIT_WATCH_LIST,
-	"WATCH_REM":                AUDIT_WATCH_REM,
+	"APPARMOR":                  AUDIT_AA,
+	"ACCT_LOCK":                 AUDIT_ACCT_LOCK,
+	"ACCT_UNLOCK":               AUDIT_ACCT_UNLOCK,
+	"ADD":                       AUDIT_ADD,
+	"ADD_GROUP":                 AUDIT_ADD_GROUP,
+	"ADD_RULE":                  AUDIT_ADD_RULE,
+	"ADD_USER":                  AUDIT_ADD_USER,
+	"ANOM_ABEND":                AUDIT_ANOM_ABEND,
+	"ANOM_ACCESS_FS":            AUDIT_ANOM_ACCESS_FS,
+	"ANOM_ADD_ACCT":             AUDIT_ANOM_ADD_ACCT,
+	"ANOM_AMTU_FAIL":            AUDIT_ANOM_AMTU_FAIL,
+	"ANOM_CREAT":                AUDIT_ANOM_CREAT,
+	"ANOM_CRYPTO_FAIL":          AUDIT_ANOM_CRYPTO_FAIL,
+	"ANOM_DEL_ACCT":             AUDIT_ANOM_DEL_ACCT,
+	"ANOM_EXEC":                 AUDIT_ANOM_EXEC,
+	"ANOM_LINK":                 AUDIT_ANOM_LINK,
+	"ANOM_LOGIN_ACCT":           AUDIT_ANOM_LOGIN_ACCT,
+	"ANOM_LOGIN_FAILURES":       AUDIT_ANOM_LOGIN_FAILURES,
+	"ANOM_LOGIN_LOCATION":       AUDIT_ANOM_LOGIN_LOCATION,
+	"ANOM_LOGIN_ROOT":           AUDIT_ANOM_LOGIN_ROOT,
+	"ANOM_LOGIN_SERVICE":        AUDIT_ANOM_LOGIN_SERVICE,
+	"ANOM_LOGIN_SESSIONS":       AUDIT_ANOM_LOGIN_SESSIONS,
+	"ANOM_LOGIN_TIME":           AUDIT_ANOM_LOGIN_TIME,
+	"ANOM_MAX_DAC":              AUDIT_ANOM_MAX_DAC,
+	"ANOM_MAX_MAC":              AUDIT_ANOM_MAX_MAC,
+	"ANOM_MK_EXEC":              AUDIT_ANOM_MK_EXEC,
+	"ANOM_MOD_ACCT":             AUDIT_ANOM_MOD_ACCT,
+	"ANOM_ORIGIN_FAILURES":      AUDIT_ANOM_ORIGIN_FAILURES,
+	"ANOM_PROMISCUOUS":          AUDIT_ANOM_PROMISCUOUS,
+	"ANOM_RBAC_FAIL":            AUDIT_ANOM_RBAC_FAIL,
+	"ANOM_RBAC_INTEGRITY_FAIL":  AUDIT_ANOM_RBAC_INTEGRITY_FAIL,
+	"ANOM_ROOT_TRANS":           AUDIT_ANOM_ROOT_TRANS,
+	"ANOM_SESSION":              AUDIT_ANOM_SESSION,
+	"APPARMOR_ALLOWED":          AUDIT_APPARMOR_ALLOWED,
+	"APPARMOR_AUDIT":            AUDIT_APPARMOR_AUDIT,
+	"APPARMOR_DENIED":           AUDIT_APPARMOR_DENIED,
+	"APPARMOR_ERROR":            AUDIT_APPARMOR_ERROR,
+	"APPARMOR_HINT":             AUDIT_APPARMOR_HINT,
+	"APPARMOR_KILL":             AUDIT_APPARMOR_KILL,
+	"APPARMOR_STATUS":           AUDIT_APPARMOR_STATUS,
+	"AVC":                       AUDIT_AVC,
+	"AVC_PATH":                  AUDIT_AVC_PATH,
+	"BPF":                       AUDIT_BPF,
+	"BPRM_FCAPS":                AUDIT_BPRM_FCAPS,
+	"CAPSET":                    AUDIT_CAPSET,
+	"CHGRP_ID":                  AUDIT_CHGRP_ID,
+	"CHUSER_ID":                 AUDIT_CHUSER_ID,
+	"CONFIG_CHANGE":             AUDIT_CONFIG_CHANGE,
+	"CRED_ACQ":                  AUDIT_CRED_ACQ,
+	"CRED_DISP":                 AUDIT_CRED_DISP,
+	"CRED_REFR":                 AUDIT_CRED_REFR,
+	"CRYPTO_FAILURE_USER":       AUDIT_CRYPTO_FAILURE_USER,
+	"CRYPTO_IKE_SA":             AUDIT_CRYPTO_IKE_SA,
+	"CRYPTO_IPSEC_SA":           AUDIT_CRYPTO_IPSEC_SA,
+	"CRYPTO_KEY_USER":           AUDIT_CRYPTO_KEY_USER,
+	"CRYPTO_LOGIN":              AUDIT_CRYPTO_LOGIN,
+	"CRYPTO_LOGOUT":             AUDIT_CRYPTO_LOGOUT,
+	"CRYPTO_PARAM_CHANGE_USER":  AUDIT_CRYPTO_PARAM_CHANGE_USER,
+	"CRYPTO_REPLAY_USER":        AUDIT_CRYPTO_REPLAY_USER,
+	"CRYPTO_SESSION":            AUDIT_CRYPTO_SESSION,
+	"CRYPTO_TEST_USER":          AUDIT_CRYPTO_TEST_USER,
+	"CWD":                       AUDIT_CWD,
+	"DAC_CHECK":                 AUDIT_DAC_CHECK,
+	"DAEMON_ABORT":              AUDIT_DAEMON_ABORT,
+	"DAEMON_ACCEPT":             AUDIT_DAEMON_ACCEPT,
+	"DAEMON_CLOSE":              AUDIT_DAEMON_CLOSE,
+	"DAEMON_CONFIG":             AUDIT_DAEMON_CONFIG,
+	"DAEMON_END":                AUDIT_DAEMON_END,
+	"DAEMON_ERR":                AUDIT_DAEMON_ERR,
+	"DAEMON_RECONFIG":           AUDIT_DAEMON_RECONFIG,
+	"DAEMON_RESUME":             AUDIT_DAEMON_RESUME,
+	"DAEMON_ROTATE":             AUDIT_DAEMON_ROTATE,
+	"DAEMON_START":              AUDIT_DAEMON_START,
+	"DEL":                       AUDIT_DEL,
+	"DEL_GROUP":                 AUDIT_DEL_GROUP,
+	"DEL_RULE":                  AUDIT_DEL_RULE,
+	"DEL_USER":                  AUDIT_DEL_USER,
+	"DEV_ALLOC":                 AUDIT_DEV_ALLOC,
+	"DEV_DEALLOC":               AUDIT_DEV_DEALLOC,
+	"DM_CTRL":                   AUDIT_DM_CTRL,
+	"DM_EVENT":                  AUDIT_DM_EVENT,
+	"EOE":                       AUDIT_EOE,
+	"EVENT_LISTENER":            AUDIT_EVENT_LISTENER,
+	"EXECVE":                    AUDIT_EXECVE,
+	"FANOTIFY":                  AUDIT_FANOTIFY,
+	"FD_PAIR":                   AUDIT_FD_PAIR,
+	"FEATURE_CHANGE":            AUDIT_FEATURE_CHANGE,
+	"FIRST_KERN_CRYPTO_MSG":     AUDIT_FIRST_KERN_CRYPTO_MSG,
+	"FS_RELABEL":                AUDIT_FS_RELABEL,
+	"GET":                       AUDIT_GET,
+	"GET_FEATURE":               AUDIT_GET_FEATURE,
+	"GRP_AUTH":                  AUDIT_GRP_AUTH,
+	"GRP_CHAUTHTOK":             AUDIT_GRP_CHAUTHTOK,
+	"GRP_MGMT":                  AUDIT_GRP_MGMT,
+	"INTEGRITY_DATA":            AUDIT_INTEGRITY_DATA,
+	"INTEGRITY_EVM_XATTR":       AUDIT_INTEGRITY_EVM_XATTR,
+	"INTEGRITY_HASH":            AUDIT_INTEGRITY_HASH,
+	"INTEGRITY_LAST_MSG":        AUDIT_INTEGRITY_LAST_MSG,
+	"INTEGRITY_METADATA":        AUDIT_INTEGRITY_METADATA,
+	"INTEGRITY_PCR":             AUDIT_INTEGRITY_PCR,
+	"INTEGRITY_POLICY_RULE":     AUDIT_INTEGRITY_POLICY_RULE,
+	"INTEGRITY_RULE":            AUDIT_INTEGRITY_RULE,
+	"INTEGRITY_STATUS":          AUDIT_INTEGRITY_STATUS,
+	"IPC":                       AUDIT_IPC,
+	"IPC_SET_PERM":              AUDIT_IPC_SET_PERM,
+	"KERNEL":                    AUDIT_KERNEL,
+	"KERNEL_OTHER":              AUDIT_KERNEL_OTHER,
+	"KERN_MODULE":               AUDIT_KERN_MODULE,
+	"LABEL_LEVEL_CHANGE":        AUDIT_LABEL_LEVEL_CHANGE,
+	"LABEL_OVERRIDE":            AUDIT_LABEL_OVERRIDE,
+	"LAST_ANOM_MSG":             AUDIT_LAST_ANOM_MSG,
+	"LAST_ANOM_RESP":            AUDIT_LAST_ANOM_RESP,
+	"LAST_APPARMOR":             AUDIT_LAST_APPARMOR,
+	"LAST_CRYPTO_MSG":           AUDIT_LAST_CRYPTO_MSG,
+	"LAST_DAEMON":               AUDIT_LAST_DAEMON,
+	"LAST_EVENT":                AUDIT_LAST_EVENT,
+	"LAST_KERN_ANOM_MSG":        AUDIT_LAST_KERN_ANOM_MSG,
+	"LAST_KERN_CRYPTO_MSG":      AUDIT_LAST_KERN_CRYPTO_MSG,
+	"LAST_SELINUX":              AUDIT_LAST_SELINUX,
+	"LAST_USER_LSPP_MSG":        AUDIT_LAST_USER_LSPP_MSG,
+	"LAST_USER_MSG":             AUDIT_LAST_USER_MSG,
+	"LAST_USER_MSG2":            AUDIT_LAST_USER_MSG2,
+	"LAST_VIRT_MSG":             AUDIT_LAST_VIRT_MSG,
+	"LIST":                      AUDIT_LIST,
+	"LIST_RULES":                AUDIT_LIST_RULES,
+	"LOGIN":                     AUDIT_LOGIN,
+	"MAC_CALIPSO_ADD":           AUDIT_MAC_CALIPSO_ADD,
+	"MAC_CALIPSO_DEL":           AUDIT_MAC_CALIPSO_DEL,
+	"MAC_CHECK":                 AUDIT_MAC_CHECK,
+	"MAC_CIPSOV4_ADD":           AUDIT_MAC_CIPSOV4_ADD,
+	"MAC_CIPSOV4_DEL":           AUDIT_MAC_CIPSOV4_DEL,
+	"MAC_CONFIG_CHANGE":         AUDIT_MAC_CONFIG_CHANGE,
+	"MAC_IPSEC_ADDSA":           AUDIT_MAC_IPSEC_ADDSA,
+	"MAC_IPSEC_ADDSPD":          AUDIT_MAC_IPSEC_ADDSPD,
+	"MAC_IPSEC_DELSA":           AUDIT_MAC_IPSEC_DELSA,
+	"MAC_IPSEC_DELSPD":          AUDIT_MAC_IPSEC_DELSPD,
+	"MAC_IPSEC_EVENT":           AUDIT_MAC_IPSEC_EVENT,
+	"MAC_MAP_ADD":               AUDIT_MAC_MAP_ADD,
+	"MAC_MAP_DEL":               AUDIT_MAC_MAP_DEL,
+	"MAC_POLICY_LOAD":           AUDIT_MAC_POLICY_LOAD,
+	"MAC_STATUS":                AUDIT_MAC_STATUS,
+	"MAC_UNLBL_ALLOW":           AUDIT_MAC_UNLBL_ALLOW,
+	"MAC_UNLBL_STCADD":          AUDIT_MAC_UNLBL_STCADD,
+	"MAC_UNLBL_STCDEL":          AUDIT_MAC_UNLBL_STCDEL,
+	"MAKE_EQUIV":                AUDIT_MAKE_EQUIV,
+	"MMAP":                      AUDIT_MMAP,
+	"MQ_GETSETATTR":             AUDIT_MQ_GETSETATTR,
+	"MQ_NOTIFY":                 AUDIT_MQ_NOTIFY,
+	"MQ_OPEN":                   AUDIT_MQ_OPEN,
+	"MQ_SENDRECV":               AUDIT_MQ_SENDRECV,
+	"NETFILTER_CFG":             AUDIT_NETFILTER_CFG,
+	"NETFILTER_PKT":             AUDIT_NETFILTER_PKT,
+	"OBJ_PID":                   AUDIT_OBJ_PID,
+	"OPENAT2":                   AUDIT_OPENAT2,
+	"PATH":                      AUDIT_PATH,
+	"PROCTITLE":                 AUDIT_PROCTITLE,
+	"REPLACE":                   AUDIT_REPLACE,
+	"RESP_ACCT_LOCK":            AUDIT_RESP_ACCT_LOCK,
+	"RESP_ACCT_LOCK_TIMED":      AUDIT_RESP_ACCT_LOCK_TIMED,
+	"RESP_ACCT_REMOTE":          AUDIT_RESP_ACCT_REMOTE,
+	"RESP_ACCT_UNLOCK_TIMED":    AUDIT_RESP_ACCT_UNLOCK_TIMED,
+	"RESP_ALERT":                AUDIT_RESP_ALERT,
+	"RESP_ANOMALY":              AUDIT_RESP_ANOMALY,
+	"RESP_EXEC":                 AUDIT_RESP_EXEC,
+	"RESP_HALT":                 AUDIT_RESP_HALT,
+	"RESP_KILL_PROC":            AUDIT_RESP_KILL_PROC,
+	"RESP_ORIGIN_BLOCK":         AUDIT_RESP_ORIGIN_BLOCK,
+	"RESP_ORIGIN_BLOCK_TIMED":   AUDIT_RESP_ORIGIN_BLOCK_TIMED,
+	"RESP_ORIGIN_UNBLOCK_TIMED": AUDIT_RESP_ORIGIN_UNBLOCK_TIMED,
+	"RESP_SEBOOL":               AUDIT_RESP_SEBOOL,
+	"RESP_SINGLE":               AUDIT_RESP_SINGLE,
+	"RESP_TERM_ACCESS":          AUDIT_RESP_TERM_ACCESS,
+	"RESP_TERM_LOCK":            AUDIT_RESP_TERM_LOCK,
+	"ROLE_ASSIGN":               AUDIT_ROLE_ASSIGN,
+	"ROLE_MODIFY":               AUDIT_ROLE_MODIFY,
+	"ROLE_REMOVE":               AUDIT_ROLE_REMOVE,
+	"SECCOMP":                   AUDIT_SECCOMP,
+	"SELINUX_ERR":               AUDIT_SELINUX_ERR,
+	"SERVICE_START":             AUDIT_SERVICE_START,
+	"SERVICE_STOP":              AUDIT_SERVICE_STOP,
+	"SET":                       AUDIT_SET,
+	"SET_FEATURE":               AUDIT_SET_FEATURE,
+	"SIGNAL_INFO":               AUDIT_SIGNAL_INFO,
+	"SOCKADDR":                  AUDIT_SOCKADDR,
+	"SOCKETCALL":                AUDIT_SOCKETCALL,
+	"SOFTWARE_UPDATE":           AUDIT_SOFTWARE_UPDATE,
+	"SYSCALL":                   AUDIT_SYSCALL,
+	"SYSTEM_BOOT":               AUDIT_SYSTEM_BOOT,
+	"SYSTEM_RUNLEVEL":           AUDIT_SYSTEM_RUNLEVEL,
+	"SYSTEM_SHUTDOWN":           AUDIT_SYSTEM_SHUTDOWN,
+	"TEST":                      AUDIT_TEST,
+	"TIME_ADJNTPVAL":            AUDIT_TIME_ADJNTPVAL,
+	"TIME_INJOFFSET":            AUDIT_TIME_INJOFFSET,
+	"TRIM":                      AUDIT_TRIM,
+	"TRUSTED_APP":               AUDIT_TRUSTED_APP,
+	"TTY":                       AUDIT_TTY,
+	"TTY_GET":                   AUDIT_TTY_GET,
+	"TTY_SET":                   AUDIT_TTY_SET,
+	"URINGOP":                   AUDIT_URINGOP,
+	"USER":                      AUDIT_USER,
+	"USER_ACCT":                 AUDIT_USER_ACCT,
+	"USER_AUTH":                 AUDIT_USER_AUTH,
+	"USER_AVC":                  AUDIT_USER_AVC,
+	"USER_CHAUTHTOK":            AUDIT_USER_CHAUTHTOK,
+	"USER_CMD":                  AUDIT_USER_CMD,
+	"USER_DEVICE":               AUDIT_USER_DEVICE,
+	"USER_END":                  AUDIT_USER_END,
+	"USER_ERR":                  AUDIT_USER_ERR,
+	"USER_LABELED_EXPORT":       AUDIT_USER_LABELED_EXPORT,
+	"USER_LOGIN":                AUDIT_USER_LOGIN,
+	"USER_LOGOUT":               AUDIT_USER_LOGOUT,
+	"USER_MAC_CONFIG_CHANGE":    AUDIT_USER_MAC_CONFIG_CHANGE,
+	"USER_MAC_POLICY_LOAD":      AUDIT_USER_MAC_POLICY_LOAD,
+	"USER_MAC_STATUS":           AUDIT_USER_MAC_STATUS,
+	"USER_MGMT":                 AUDIT_USER_MGMT,
+	"USER_ROLE_CHANGE":          AUDIT_USER_ROLE_CHANGE,
+	"USER_SELINUX_ERR":          AUDIT_USER_SELINUX_ERR,
+	"USER_START":                AUDIT_USER_START,
+	"USER_TTY":                  AUDIT_USER_TTY,
+	"USER_UNLABELED_EXPORT":     AUDIT_USER_UNLABELED_EXPORT,
+	"USYS_CONFIG":               AUDIT_USYS_CONFIG,
+	"VIRT_CONTROL":              AUDIT_VIRT_CONTROL,
+	"VIRT_CREATE":               AUDIT_VIRT_CREATE,
+	"VIRT_DESTROY":              AUDIT_VIRT_DESTROY,
+	"VIRT_INTEGRITY_CHECK":      AUDIT_VIRT_INTEGRITY_CHECK,
+	"VIRT_MACHINE_ID":           AUDIT_VIRT_MACHINE_ID,
+	"VIRT_MIGRATE_IN":           AUDIT_VIRT_MIGRATE_IN,
+	"VIRT_MIGRATE_OUT":          AUDIT_VIRT_MIGRATE_OUT,
+	"VIRT_RESOURCE":             AUDIT_VIRT_RESOURCE,
+	"WATCH_INS":                 AUDIT_WATCH_INS,
+	"WATCH_LIST":                AUDIT_WATCH_LIST,
+	"WATCH_REM":                 AUDIT_WATCH_REM,
 }
 
 // GetAuditMessageType accepts a type name and returns its numerical
diff --git a/auparse/zaudit_syscalls.go b/auparse/zaudit_syscalls.go
index 80d4b05..abf800b 100644
--- a/auparse/zaudit_syscalls.go
+++ b/auparse/zaudit_syscalls.go
@@ -298,6 +298,36 @@ var AuditSyscalls = map[string]map[int]string{
 		288: "pkey_mprotect",
 		289: "pkey_alloc",
 		290: "pkey_free",
+		291: "statx",
+		292: "io_pgetevents",
+		293: "rseq",
+		294: "kexec_file_load",
+		424: "pidfd_send_signal",
+		425: "io_uring_setup",
+		426: "io_uring_enter",
+		427: "io_uring_register",
+		428: "open_tree",
+		429: "move_mount",
+		430: "fsopen",
+		431: "fsconfig",
+		432: "fsmount",
+		433: "fspick",
+		434: "pidfd_open",
+		435: "clone3",
+		436: "close_range",
+		437: "openat2",
+		438: "pidfd_getfd",
+		439: "faccessat2",
+		440: "process_madvise",
+		441: "epoll_pwait2",
+		442: "mount_setattr",
+		443: "quotactl_fd",
+		444: "landlock_create_ruleset",
+		445: "landlock_add_rule",
+		446: "landlock_restrict_self",
+		447: "memfd_secret",
+		448: "process_mrelease",
+		449: "futex_waitv",
 	},
 	"arm": {
 		0:   "restart_syscall",
@@ -662,6 +692,55 @@ var AuditSyscalls = map[string]map[int]string{
 		395: "pkey_alloc",
 		396: "pkey_free",
 		397: "statx",
+		398: "rseq",
+		399: "io_pgetevents",
+		400: "migrate_pages",
+		401: "kexec_file_load",
+		403: "clock_gettime64",
+		404: "clock_settime64",
+		405: "clock_adjtime64",
+		406: "clock_getres_time64",
+		407: "clock_nanosleep_time64",
+		408: "timer_gettime64",
+		409: "timer_settime64",
+		410: "timerfd_gettime64",
+		411: "timerfd_settime64",
+		412: "utimensat_time64",
+		413: "pselect6_time64",
+		414: "ppoll_time64",
+		416: "io_pgetevents_time64",
+		417: "recvmmsg_time64",
+		418: "mq_timedsend_time64",
+		419: "mq_timedreceive_time64",
+		420: "semtimedop_time64",
+		421: "rt_sigtimedwait_time64",
+		422: "futex_time64",
+		423: "sched_rr_get_interval64",
+		424: "pidfd_send_signal",
+		425: "io_uring_setup",
+		426: "io_uring_enter",
+		427: "io_uring_register",
+		428: "open_tree",
+		429: "move_mount",
+		430: "fsopen",
+		431: "fsconfig",
+		432: "fsmount",
+		433: "fspick",
+		434: "pidfd_open",
+		435: "clone3",
+		436: "close_range",
+		437: "openat2",
+		438: "pidfd_getfd",
+		439: "faccessat2",
+		440: "process_madvise",
+		441: "epoll_pwait2",
+		442: "mount_setattr",
+		443: "quotactl_fd",
+		444: "landlock_create_ruleset",
+		445: "landlock_add_rule",
+		446: "landlock_restrict_self",
+		448: "process_mrelease",
+		449: "futex_waitv",
 	},
 	"i386": {
 		0:   "restart_syscall",
@@ -982,7 +1061,7 @@ var AuditSyscalls = map[string]map[int]string{
 		319: "epoll_pwait",
 		320: "utimensat",
 		321: "signalfd",
-		322: "timerfd",
+		322: "timerfd_create",
 		323: "eventfd",
 		324: "fallocate",
 		325: "timerfd_settime",
@@ -1044,328 +1123,65 @@ var AuditSyscalls = map[string]map[int]string{
 		381: "pkey_alloc",
 		382: "pkey_free",
 		383: "statx",
-	},
-	"ia64": {
-		1024: "ni_syscall",
-		1025: "exit",
-		1026: "read",
-		1027: "write",
-		1028: "open",
-		1029: "close",
-		1030: "creat",
-		1031: "link",
-		1032: "unlink",
-		1033: "execve",
-		1034: "chdir",
-		1035: "fchdir",
-		1036: "utimes",
-		1037: "mknod",
-		1038: "chmod",
-		1039: "chown",
-		1040: "lseek",
-		1041: "getpid",
-		1042: "getppid",
-		1043: "mount",
-		1044: "umount",
-		1045: "setuid",
-		1046: "getuid",
-		1047: "geteuid",
-		1048: "ptrace",
-		1049: "access",
-		1050: "sync",
-		1051: "fsync",
-		1052: "fdatasync",
-		1053: "kill",
-		1054: "rename",
-		1055: "mkdir",
-		1056: "rmdir",
-		1057: "dup",
-		1058: "pipe",
-		1059: "times",
-		1060: "brk",
-		1061: "setgid",
-		1062: "getgid",
-		1063: "getegid",
-		1064: "acct",
-		1065: "ioctl",
-		1066: "fcntl",
-		1067: "umask",
-		1068: "chroot",
-		1069: "ustat",
-		1070: "dup2",
-		1071: "setreuid",
-		1072: "setregid",
-		1073: "getresuid",
-		1074: "setresuid",
-		1075: "getresgid",
-		1076: "setresgid",
-		1077: "getgroups",
-		1078: "setgroups",
-		1079: "getpgid",
-		1080: "setpgid",
-		1081: "setsid",
-		1082: "getsid",
-		1083: "sethostname",
-		1084: "setrlimit",
-		1085: "getrlimit",
-		1086: "getrusage",
-		1087: "gettimeofday",
-		1088: "settimeofday",
-		1089: "select",
-		1090: "poll",
-		1091: "symlink",
-		1092: "readlink",
-		1093: "uselib",
-		1094: "swapon",
-		1095: "swapoff",
-		1096: "reboot",
-		1097: "truncate",
-		1098: "ftruncate",
-		1099: "fchmod",
-		1100: "fchown",
-		1101: "getpriority",
-		1102: "setpriority",
-		1103: "statfs",
-		1104: "fstatfs",
-		1105: "gettid",
-		1106: "semget",
-		1107: "semop",
-		1108: "semctl",
-		1109: "msgget",
-		1110: "msgsnd",
-		1111: "msgrcv",
-		1112: "msgctl",
-		1113: "shmget",
-		1114: "shmat",
-		1115: "shmdt",
-		1116: "shmctl",
-		1117: "syslog",
-		1118: "setitimer",
-		1119: "getitimer",
-		1120: "tux",
-		1123: "vhangup",
-		1124: "lchown",
-		1125: "remap_file_pages",
-		1126: "wait4",
-		1127: "sysinfo",
-		1128: "clone",
-		1129: "setdomainname",
-		1130: "uname",
-		1131: "adjtimex",
-		1133: "init_module",
-		1134: "delete_module",
-		1137: "quotactl",
-		1138: "bdflush",
-		1139: "sysfs",
-		1140: "personality",
-		1141: "afs_syscall",
-		1142: "setfsuid",
-		1143: "setfsgid",
-		1144: "getdents",
-		1145: "flock",
-		1146: "readv",
-		1147: "writev",
-		1148: "pread64",
-		1149: "pwrite64",
-		1150: "_sysctl",
-		1151: "mmap",
-		1152: "munmap",
-		1153: "mlock",
-		1154: "mlockall",
-		1155: "mprotect",
-		1156: "mremap",
-		1157: "msync",
-		1158: "munlock",
-		1159: "munlockall",
-		1160: "sched_getparam",
-		1161: "sched_setparam",
-		1162: "sched_getscheduler",
-		1163: "sched_setscheduler",
-		1164: "sched_yield",
-		1165: "sched_get_priority_max",
-		1166: "sched_get_priority_min",
-		1167: "sched_rr_get_interval",
-		1168: "nanosleep",
-		1169: "nfsservctl",
-		1170: "prctl",
-		1172: "mmap2",
-		1173: "pciconfig_read",
-		1174: "pciconfig_write",
-		1175: "perfmonctl",
-		1176: "sigaltstack",
-		1177: "rt_sigaction",
-		1178: "rt_sigpending",
-		1179: "rt_sigprocmask",
-		1180: "rt_sigqueueinfo",
-		1181: "rt_sigreturn",
-		1182: "rt_sigsuspend",
-		1183: "rt_sigtimedwait",
-		1184: "getcwd",
-		1185: "capget",
-		1186: "capset",
-		1187: "sendfile",
-		1188: "getpmsg",
-		1189: "putpmsg",
-		1190: "socket",
-		1191: "bind",
-		1192: "connect",
-		1193: "listen",
-		1194: "accept",
-		1195: "getsockname",
-		1196: "getpeername",
-		1197: "socketpair",
-		1198: "send",
-		1199: "sendto",
-		1200: "recv",
-		1201: "recvfrom",
-		1202: "shutdown",
-		1203: "setsockopt",
-		1204: "getsockopt",
-		1205: "sendmsg",
-		1206: "recvmsg",
-		1207: "pivot_root",
-		1208: "mincore",
-		1209: "madvise",
-		1210: "stat",
-		1211: "lstat",
-		1212: "fstat",
-		1213: "clone2",
-		1214: "getdents64",
-		1215: "getunwind",
-		1216: "readahead",
-		1217: "setxattr",
-		1218: "lsetxattr",
-		1219: "fsetxattr",
-		1220: "getxattr",
-		1221: "lgetxattr",
-		1222: "fgetxattr",
-		1223: "listxattr",
-		1224: "llistxattr",
-		1225: "flistxattr",
-		1226: "removexattr",
-		1227: "lremovexattr",
-		1228: "fremovexattr",
-		1229: "tkill",
-		1230: "futex",
-		1231: "sched_setaffinity",
-		1232: "sched_getaffinity",
-		1233: "set_tid_address",
-		1234: "fadvise64",
-		1235: "tgkill",
-		1236: "exit_group",
-		1237: "lookup_dcookie",
-		1238: "io_setup",
-		1239: "io_destroy",
-		1240: "io_getevents",
-		1241: "io_submit",
-		1242: "io_cancel",
-		1243: "epoll_create",
-		1244: "epoll_ctl",
-		1245: "epoll_wait",
-		1246: "restart_syscall",
-		1247: "semtimedop",
-		1248: "timer_create",
-		1249: "timer_settime",
-		1250: "timer_gettime",
-		1251: "timer_getoverrun",
-		1252: "timer_delete",
-		1253: "clock_settime",
-		1254: "clock_gettime",
-		1255: "clock_getres",
-		1256: "clock_nanosleep",
-		1257: "fstatfs64",
-		1258: "statfs64",
-		1259: "mbind",
-		1260: "get_mempolicy",
-		1261: "set_mempolicy",
-		1262: "mq_open",
-		1263: "mq_unlink",
-		1264: "mq_timedsend",
-		1265: "mq_timedreceive",
-		1266: "mq_notify",
-		1267: "mq_getsetattr",
-		1268: "kexec_load",
-		1269: "vserver",
-		1270: "waitid",
-		1271: "add_key",
-		1272: "request_key",
-		1273: "keyctl",
-		1274: "ioprio_set",
-		1275: "ioprio_get",
-		1276: "set_zone_reclaim",
-		1277: "inotify_init",
-		1278: "inotify_add_watch",
-		1279: "inotify_rm_watch",
-		1280: "migrate_pages",
-		1281: "openat",
-		1282: "mkdirat",
-		1283: "mknodat",
-		1284: "fchownat",
-		1285: "futimesat",
-		1286: "newfstatat",
-		1287: "unlinkat",
-		1288: "renameat",
-		1289: "linkat",
-		1290: "symlinkat",
-		1291: "readlinkat",
-		1292: "fchmodat",
-		1293: "faccessat",
-		1294: "pselect",
-		1295: "ppoll",
-		1296: "unshare",
-		1297: "splice",
-		1298: "set_robust_list",
-		1299: "get_robust_list",
-		1300: "sync_file_range",
-		1301: "tee",
-		1302: "vmsplice",
-		1303: "fallocate",
-		1304: "getcpu",
-		1305: "epoll_pwait",
-		1306: "utimensat",
-		1307: "signalfd",
-		1308: "timerfd",
-		1309: "eventfd",
-		1310: "timerfd_create",
-		1311: "timerfd_settime",
-		1312: "timerfd_gettime",
-		1313: "signalfd4",
-		1314: "eventfd2",
-		1315: "epoll_create1",
-		1316: "dup3",
-		1317: "pipe2",
-		1318: "inotify_init1",
-		1319: "preadv",
-		1320: "pwritev",
-		1321: "rt_tgsigqueueinfo",
-		1322: "recvmmsg",
-		1323: "fanotify_init",
-		1324: "fanotify_mark",
-		1325: "prlimit64",
-		1326: "name_to_handle_at",
-		1327: "open_by_handle_at",
-		1328: "clock_adjtime",
-		1329: "syncfs",
-		1330: "setns",
-		1331: "sendmmsg",
-		1332: "process_vm_readv",
-		1333: "process_vm_writev",
-		1334: "accept4",
-		1335: "finit_module",
-		1336: "sched_setattr",
-		1337: "sched_getattr",
-		1338: "renameat2",
-		1339: "getrandom",
-		1340: "memfd_create",
-		1341: "bpf",
-		1342: "execveat",
-		1343: "userfaultfd",
-		1344: "membarrier",
-		1345: "kcmp",
-		1346: "mlock2",
-		1347: "copy_file_range",
-		1348: "preadv2",
-		1349: "pwritev2",
+		384: "arch_prctl",
+		385: "io_pgetevents",
+		386: "rseq",
+		393: "semget",
+		394: "semctl",
+		395: "shmget",
+		396: "shmctl",
+		397: "shmat",
+		398: "shmdt",
+		399: "msgget",
+		400: "msgsnd",
+		401: "msgrcv",
+		402: "msgctl",
+		403: "clock_gettime64",
+		404: "clock_settime64",
+		405: "clock_adjtime64",
+		406: "clock_getres_time64",
+		407: "clock_nanosleep_time64",
+		408: "timer_gettime64",
+		409: "timer_settime64",
+		410: "timerfd_gettime64",
+		411: "timerfd_settime64",
+		412: "utimensat_time64",
+		413: "pselect6_time64",
+		414: "ppoll_time64",
+		416: "io_pgetevents_time64",
+		417: "recvmmsg_time64",
+		418: "mq_timedsend_time64",
+		419: "mq_timedreceive_time64",
+		420: "semtimedop_time64",
+		421: "rt_sigtimedwait_time64",
+		422: "futex_time64",
+		423: "sched_rr_get_interval64",
+		424: "pidfd_send_signal",
+		425: "io_uring_setup",
+		426: "io_uring_enter",
+		427: "io_uring_register",
+		428: "open_tree",
+		429: "move_mount",
+		430: "fsopen",
+		431: "fsconfig",
+		432: "fsmount",
+		433: "fspick",
+		434: "pidfd_open",
+		435: "clone3",
+		436: "close_range",
+		437: "openat2",
+		438: "pidfd_getfd",
+		439: "faccessat2",
+		440: "process_madvise",
+		441: "epoll_pwait2",
+		442: "mount_setattr",
+		443: "quotactl_fd",
+		444: "landlock_create_ruleset",
+		445: "landlock_add_rule",
+		446: "landlock_restrict_self",
+		447: "memfd_secret",
+		448: "process_mrelease",
+		449: "futex_waitv",
 	},
 	"ppc": {
 		1:   "exit",
@@ -1732,6 +1548,67 @@ var AuditSyscalls = map[string]map[int]string{
 		381: "pwritev2",
 		382: "kexec_file_load",
 		383: "statx",
+		384: "pkey_alloc",
+		385: "pkey_free",
+		386: "pkey_mprotect",
+		387: "rseq",
+		388: "io_pgetevents",
+		392: "semtimedop",
+		393: "semget",
+		394: "semctl",
+		395: "shmget",
+		396: "shmctl",
+		397: "shmat",
+		398: "shmdt",
+		399: "msgget",
+		400: "msgsnd",
+		401: "msgrcv",
+		402: "msgctl",
+		403: "clock_gettime64",
+		404: "clock_settime64",
+		405: "clock_adjtime64",
+		406: "clock_getres_time64",
+		407: "clock_nanosleep_time64",
+		408: "timer_gettime64",
+		409: "timer_settime64",
+		410: "timerfd_gettime64",
+		411: "timerfd_settime64",
+		412: "utimensat_time64",
+		413: "pselect6_time64",
+		414: "ppoll_time64",
+		416: "io_pgetevents_time64",
+		417: "recvmmsg_time64",
+		418: "mq_timedsend_time64",
+		419: "mq_timedreceive_time64",
+		420: "semtimedop_time64",
+		421: "rt_sigtimedwait_time64",
+		422: "futex_time64",
+		423: "sched_rr_get_interval_time64",
+		424: "pidfd_send_signal",
+		425: "io_uring_setup",
+		426: "io_uring_enter",
+		427: "io_uring_register",
+		428: "open_tree",
+		429: "move_mount",
+		430: "fsopen",
+		431: "fsconfig",
+		432: "fsmount",
+		433: "fspick",
+		434: "pidfd_open",
+		435: "clone3",
+		436: "close_range",
+		437: "openat2",
+		438: "pidfd_getfd",
+		439: "faccessat2",
+		440: "process_madvise",
+		441: "epoll_pwait2",
+		442: "mount_setattr",
+		443: "quotactl_fd",
+		444: "landlock_create_ruleset",
+		445: "landlock_add_rule",
+		446: "landlock_restrict_self",
+		448: "process_mrelease",
+		449: "futex_waitv",
 	},
 	"s390": {
 		1:   "exit",
@@ -2083,6 +1960,38 @@ var AuditSyscalls = map[string]map[int]string{
 		376: "preadv2",
 		377: "pwritev2",
 		379: "statx",
+		380: "s390_sthyi",
+		381: "kexec_file_load",
+		382: "io_pgetevents",
+		383: "rseq",
+		384: "pkey_mprotect",
+		385: "pkey_alloc",
+		386: "pkey_free",
+		424: "pidfd_send_signal",
+		425: "io_uring_setup",
+		426: "io_uring_enter",
+		427: "io_uring_register",
+		428: "open_tree",
+		429: "move_mount",
+		430: "fsopen",
+		431: "fsconfig",
+		432: "fsmount",
+		433: "fspick",
+		434: "pidfd_open",
+		435: "clone3",
+		436: "close_range",
+		437: "openat2",
+		438: "pidfd_getfd",
+		439: "faccessat2",
+		440: "process_madvise",
+		441: "epoll_pwait2",
+		442: "mount_setattr",
+		443: "quotactl_fd",
+		444: "landlock_create_ruleset",
+		445: "landlock_add_rule",
+		446: "landlock_restrict_self",
+		448: "process_mrelease",
+		449: "futex_waitv",
 	},
 	"s390x": {
 		1:   "exit",
@@ -2400,6 +2309,38 @@ var AuditSyscalls = map[string]map[int]string{
 		376: "preadv2",
 		377: "pwritev2",
 		379: "statx",
+		380: "s390_sthyi",
+		381: "kexec_file_load",
+		382: "io_pgetevents",
+		383: "rseq",
+		384: "pkey_mprotect",
+		385: "pkey_alloc",
+		386: "pkey_free",
+		424: "pidfd_send_signal",
+		425: "io_uring_setup",
+		426: "io_uring_enter",
+		427: "io_uring_register",
+		428: "open_tree",
+		429: "move_mount",
+		430: "fsopen",
+		431: "fsconfig",
+		432: "fsmount",
+		433: "fspick",
+		434: "pidfd_open",
+		435: "clone3",
+		436: "close_range",
+		437: "openat2",
+		438: "pidfd_getfd",
+		439: "faccessat2",
+		440: "process_madvise",
+		441: "epoll_pwait2",
+		442: "mount_setattr",
+		443: "quotactl_fd",
+		444: "landlock_create_ruleset",
+		445: "landlock_add_rule",
+		446: "landlock_restrict_self",
+		448: "process_mrelease",
+		449: "futex_waitv",
 	},
 	"x86_64": {
 		0:   "read",
@@ -2685,7 +2626,7 @@ var AuditSyscalls = map[string]map[int]string{
 		280: "utimensat",
 		281: "epoll_pwait",
 		282: "signalfd",
-		283: "timerfd",
+		283: "timerfd_create",
 		284: "eventfd",
 		285: "fallocate",
 		286: "timerfd_settime",
@@ -2735,6 +2676,34 @@ var AuditSyscalls = map[string]map[int]string{
 		330: "pkey_alloc",
 		331: "pkey_free",
 		332: "statx",
+		333: "io_pgetevents",
+		334: "rseq",
+		424: "pidfd_send_signal",
+		425: "io_uring_setup",
+		426: "io_uring_enter",
+		427: "io_uring_register",
+		428: "open_tree",
+		429: "move_mount",
+		430: "fsopen",
+		431: "fsconfig",
+		432: "fsmount",
+		433: "fspick",
+		434: "pidfd_open",
+		435: "clone3",
+		436: "close_range",
+		437: "openat2",
+		438: "pidfd_getfd",
+		439: "faccessat2",
+		440: "process_madvise",
+		441: "epoll_pwait2",
+		442: "mount_setattr",
+		443: "quotactl_fd",
+		444: "landlock_create_ruleset",
+		445: "landlock_add_rule",
+		446: "landlock_restrict_self",
+		447: "memfd_secret",
+		448: "process_mrelease",
+		449: "futex_waitv",
 	},
 }