CCI-000880 says:
"The operating system must audit non-local maintenance and diagnostic
sessions." and
"Non-local maintenance and diagnostic activities are those activities
conducted by individuals communicating through a network, either an
external network (e.g., the Internet) or an internal network, in order
to conduct system diagnostics.
For traceability of maintenance, logging events associated with a
non-local administrative access or diagnostic session must be performed."
What actions do we want to consider "maintenance and diagnostic"
commands/tools?