Use the event.monitor.commands.user.skiplist parameter to specify any users for whom you do not want to monitor the commands that they run. Any user that you specify in this parameter will not generate an audit trail event when they run any command, even if the command is listed in event.monitor.commands.