1<?xml version='1.0' ?> 2<audit> 3<record version="11" event="socket(2)" modifier="0" time="Mon Jun 11 10:18:45 2018" msec=" + 380 msec" > 4<argument arg-num="1" value="0x1c" desc="domain" /> 5<argument arg-num="2" value="0x2" desc="type" /> 6<argument arg-num="3" value="0x0" desc="protocol" /> 7<subject audit-uid="root" uid="root" gid="wheel" ruid="root" rgid="wheel" pid="7053" sid="4724" tid="37636 10.0.2.2" /> 8<return errval="success" retval="3" /> 9</record> 10<?xml version='1.0' ?> 11<audit> 12</audit> 13