Field help (AUDSYSUSR)

It corresponds to the system login of the user at the origin of the audited event. If the event has been triggered outside of the software, the login that appears here is External.