AIX Audit Events - AIX adding its own?

CONFIG FILE:
start:
        binmode = on
        streammode = off
 
bin:
        freespace = 65536
        trail = /audit/trail
        bin1 = /audit/bin1
        bin2 = /audit/bin2
        binsize = 10240
        cmds = /etc/security/audit/bincmds
 
classes:
        general = PASSWORD_Change,INSTALLP_Inst
        SRC = No_Events            
        USR = USER_Create,USER_Change,USER_Login,USER_Reboot
        GRP = GROUP_Create,GROUP_Change,GROUP_Remove
        cron = AT_JobAdd,CRON_Start
        tcpip = No_Events     
        kernel = No_Events  
        files = No_Events
        svipc = No_Events
        mail = No_Events
        objects = No_Events
        lvm = No_Events
        ldapserver = No_Events
        ipsec = No_Events
        aacct = No_Events
        ALL = PASSWORD_Change
 
users:
        root = general
 
 
<serverName@/audit>audit query
 
auditing on
audit bin manager is process 380994
audit events:
        general = PASSWORD_Change,INSTALLP_Inst
        SRC = No_Events
        USR = USER_Login,USER_Create,USER_Change,USER_Reboot
        GRP = GROUP_Create,GROUP_Change,GROUP_Remove
        cron = AT_JobAdd,CRON_Start
        tcpip = No_Events
        kernel = No_Events
        files = No_Events
        svipc = No_Events
        mail = No_Events
        objects = No_Events
        lvm = No_Events
        ldapserver = No_Events
        ipsec = No_Events
        aacct = No_Events
        ALL = PASSWORD_Change
 
<<AIX IS ADDING THIS LINE AUTOMATICALLY>>
 
        ALL = AUD_CONFIG_WR,S_USER_WRITE,S_PASSWD_READ,S_PASSWD_WRITE,S_LOGIN_WRITE,
S_LIMITS_WRITE,S_GROUP_WRITE,S_ENVIRON_WRITE,USER_SU,PASSWORD_Change,FILE_Unlink,
FILE_Link,FILE_Rename,FS_Chdir,FS_Chroot,PORT_Locked,PORT_Change,FS_Mkdir,FS_Rmdir,
SRC_Start,SRC_Stop,SRC_Addssys,SRC_Chssys,SRC_Delssys,SRC_Addserver,SRC_Chserver,
SRC_Delserver,PROC_Create,PROC_Delete,PROC_Execute,PROC_RealUID,PROC_AuditID,
PROC_RealGID,PROC_Environ,PROC_SetSignal,PROC_Limits,PROC_SetPri,PROC_Setpri,
PROC_Privilege,PROC_Settimer,FILE_Open,FILE_Read,FILE_Write,FILE_Close,FILE_Owner,FILE_Mode,
FILE_Acl,FILE_Privilege,DEV_Create,MSG_Create,MSG_Read,MSG_Write,MSG_Delete,MSG_Owner,
MSG_Mode,SEM_Create,SEM_Op,SEM_Delete,SEM_Owner,SEM_Mode,SHM_Create,SHM_Open,
SHM_Close,SHM_Owner,SHM_Mode,SENDMAIL_Config,SENDMAIL_ToFile,AT_JobAdd,AT_JobRemove,
CRON_JobAdd,CRON_JobRemove,CRON_Start,CRON_Finish,TCPIP_config,TCPIP_host_id,TCPIP_route,
TCPIP_connect,TCPIP_data_out,TCPIP_data_in,TCPIP_access,TCPIP_set_time,TCPIP_kconfig,
TCPIP_kroute,TCPIP_kconnect,TCPIP_kdata_out,TCPIP_kdata_in,TCPIP_kcreate,IPSEC_chtun,
IPSEC_export,IPSEC_gentun,IPSEC_imptun,IPSEC_lstun,IPSEC_mktun,IPSEC_rmtun,IPSEC_chfilt,
IPSEC_expfilt,IPSEC_genfilt,IPSEC_trcbuf,IPSEC_impfilt,IPSEC_lsfilt,IPSEC_mkfilt,IPSEC_mvfilt,
IPSEC_rmfilt,IPSEC_unload,IPSEC_stat,IKE_tnl_creat,IKE_tnl_delet,IPSEC_p1_nego,IPSEC_p2_nego,
IKE_activat_cmd,IKE_remove_cmd,LVM_AddLV,LVM_KDeleteLV,LVM_ExtendLV,LVM_ReduceLV,
LVM_KChangeLV,LVM_AvoidLV,LVM_MissingPV,LVM_AddPV,LVM_AddMissPV,LVM_DeletePV,
LVM_RemovePV,LVM_AddVGSA,LVM_DeleteVGSA,LVM_SetupVG,LVM_DefineVG,LVM_KDeleteVG,
LVM_ChgQuorum,LVM_Chg1016,LVM_UnlockDisk,LVM_LockDisk,LVM_ChangeLV,LVM_ChangeVG,
LVM_CreateLV,LVM_CreateVG,LVM_DeleteVG,LVM_DeleteLV,LVM_VaryoffVG,LVM_VaryonVG,LDAP_Bind,
LDAP_Unbind,LDAP_Add,LDAP_Delete,LDAP_Modify,LDAP_Modifydn,LDAP_Search,LDAP_Compare,
AACCT_On,AACCT_Off,AACCT_AddFile,AACCT_ResetFile,AACCT_RmFile,AACCT_SwtchFile,
AACCT_TridOn,AACCT_TridOff,AACCT_SysIntOff,AACCT_SysIntSet,AACCT_PrIntOff,AACCT_PrIntSet,
AACCT_SwtchProj,AACCT_AddProj,AACCT_RmProj,AACCT_PolLoad,AACCT_PolUnload,
AACCT_NotChange,AACCT_NotifyOff,AUD_It,PROC_Kill,WLM_set,PROC_Sysconfig,TCP_ksocket,
TCP_kconnect,TCP_kclose,TCP_kbind,TCP_ksetopt,PROC_Adjtime,FILE_Stat,FILE_Accessx,FILE_Dupfd,
PROC_Setpgid,TCB_Exec,PROC_Load,PROC_LoadMember,SHM_Detach,FILE_Pipe,PROC_LoadError,
FILE_FReadXacl,FILE_FWriteXacl,FILE_Fchown,PROC_SetGroups,PROC_SetUserIDs,AUD_Proc,
FILE_ReadXacl,FILE_WriteXacl,FILE_Utimes,AUD_Bin_Def,TCP_klisten,TCP_kaccept,FILE_Mknod,
FILE_StatAcl,TCP_kshutdown,TCP_ksocketpair,PROC_SetPAGVal,USER_Login,INSTALLP_Inst,
USER_Create,USER_Change,USER_Reboot,GROUP_Create,GROUP_Change,GROUP_Remove,
FILE_Fchmod,FILE_Frevoke,FILE_Facl,USER_Exit,FS_Mount,FS_Umount,INIT_End,INIT_Start,
No_Events,USER_Chpass,PASSWORD_Flags
 
audit objects:
        /etc/security/passwd:
                 r = S_PASSWD_READ
                 w = S_PASSWD_WRITE

                                  

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98: