[AUDIT] Allow filtering on system call success _or_ failure Signed-off-by: David Woodhouse <dwmw2@infradead.org>