This article is to explain the syslog message as:

 kernel: %KERN-5: audit: type=1006 audit(1701700202.520:15874): pid=21891 uid=0 old-auid=4294967295 auid=0 tty=(none) old-ses=4294967295 ses=15743 res=1

auditd is responsible for saving all events on the filesystem. It also offers everything we would expect from a Linux daemon, such as log rotation, disk-free space monitoring, etc.

kernel: audit: type=1006 audit(1703819466.234:115): pid=4253 uid=0 old-auid=4294967295 auid=2001 tty=(none) old-ses=4294967295 ses=16 res=1

Message structure:

The first item is the record type. This tells you what kind of information and the meaning of the record is. 

Next there is a msg=audit field which has parenthesis. Inside it is the time since the epoch in seconds, a millisecond time, and a serial number. The millisecond is used to separate events within the same second. The serial number is used to separate events within the same millisecond.

After the time stamp comes fields that are in key=value format. What these field are varies by record type. But the overall event should have the following:

Login ID (auid): the user ID that the user originally logged in with regardless of changing the real or effective user ID afterwards.

Session ID (ses): an identifier unique to the specific login in case the same user has multiple logins.

User ID (uid): the real user ID of the process at the time the audit event was generated.

Process ID (pid): the process ID of the subject that caused the event.

Results (res): Whether the subject's action was a success or failure.

#define AUDIT_LOGIN 1006 /* Define the login id and information */

More other record type , please refer to:

https://sites.uclouvain.be/SystInfo/usr/include/linux/audit.h.html