INSTALL=keyword(,...)

    Specifies that installation event packets are to be considered
    when selecting event records. Choose from the following keywords:

    FILE=filename          Specifies the name of the installed file.
                           You can represent all or part of the name
                           with a wildcard.

                           Note that on Alpha systems prior to
                           Version 6.1, audit log files record the
                           installed file name within an object
                           name packet. To select the installed
                           file, you must use the expression
                           OBJECT=(NAME=object-name) instead of
                           FILE=filename.

    FLAGS=flag-name        Specifies the names of the flags, which
                           correspond to qualifiers of the Install
                           utility (INSTALL); for example, OPEN
                           corresponds to /OPEN.

    PRIVILEGES=privilege-  Specifies the names of the privileges with
    name                   which the file was installed.