-.It EVFILT_SESSION
-Takes the audit session ID to monitor as the identifier and the events to watch for in
-.Va fflags ,
-and returns when one or more of the requested session events occurs.
-To monitor for events for any audit session the value AS_ANY_ASID
-should be used as the identifier. With AS_ANY_ASID, as new audit
-sessions are created they are included as if the were added
-individually. The events to monitor are:
-.Bl -tag -width NOTE_AS_UPDATE
-.It NOTE_AS_START
-A new audit session has started.
-.It NOTE_AS_END
-All the processes in the audit session have exited.
-.It NOTE_AS_CLOSE
-This audit session is no longer valid in the kernel. In other words, it
-is now safe to dispose of any cached information about this session or
-reuse its session ID for a new audit session.
-.It NOTE_AS_UPDATE
-The audit session information was updated. The audit session information is
-considered immutable once initially set. If this becomes enforced in
-the kernel then this event may no longer be needed and may become
-obsolete.
-.It NOTE_AS_ERR
-This flag is returned if the system was unable to attach an event to a
-new session when the audit session ID of AS_ANY_ASID
-is used. This is usually due to resource limitations.
-.El
-.Pp
-On return,
-.Va fflags
-contains the events which triggered the filter,
-.Va ident
-contains the audit session ID, and
-.Va data
-contains the audit user ID.
-This filter automatically sets the EV_CLEAR flag internally.