[AUDIT] Allow filtering on system call success _or_ failure