things like AUDIT_SYSCALL are always followed by parameters such as AUDIT_PATH or AUDIT_CWD and are always terminated with an AUDIT_EOF record