FLAGS=(flag-name,...)

    Identifies the names of the audit event flags associated with the
    audited event. These names should be used in selecting records.
    Specify one or more of the following flags: ACL, Alarm, Audit,
    Flush, Foreign, Internal, and Mandatory.