Help for Enable 

This window lets you start an audit session.  Because the Audit subsystem is 
designed to audit system events from system startup to system shutdown, you 
should initiate audit as soon as possible after booting the system.  

Enable uses the current audit parameter file to initialize the Audit 
subsystem.  If you enable auditing and then leave the Audit subsystem, 
auditing remains enabled until you explicitly disable it or bring your system 
down.  

When you select Enable, the system asks you to confirm that you want 
to enable auditing.  Select "OK" to start auditing or "Cancel" to return to 
the main window without doing anything.  
