/EXCLUDE=process-id
       /NOEXCLUDE=process-id

    Adds a process identification (PID) to the audit server's process
    exclusion list. The process exclusion list contains those
    processes that will not be suspended by the audit server if a
    resource exhaustion reaches the action threshold. By default,
    realtime processes and all of the following processes are
    included in the process exclusion list and are never suspended:

       CACHE_SERVER
       CLUSTER_SERVER
       CONFIGURE
       DFS$COM_ACP
       DNS$ADVER
       IPCACP
       JOB_CONTROL
       NETACP
       NET$ACP
       OPCOM
       REMACP
       SHADOW_SERVER
       SMISERVER
       SWAPPER
       TP_SERVER
       VWS$DISPLAYMGR
       VWS$EMULATORS

    Use the SET AUDIT/NOEXCLUDE command to remove a process from the
    process exclusion list; however, processes listed above cannot
    be removed from the exclusion list. Also note that PIDs are
    not automatically removed from the process exclusion list when
    processes log out of the system.