How audit trails that are output during privilege checking are related to audit trails output at event termination and how multiple records are related to events can be checked from the following information:

• For an SQL, check the combination of the server name, CONNECT sequence number, and SQL sequence number that are output in an audit trail.
• For a command or utility, check the combination of the process ID and host name that are output in an audit trail.

For details about audit trail output contents, see 24.8 Audit trail table columns.