This should be handled fine now by .dir-locals.el, so need to carry that stuff in every file.
<audit-1400> is replaced by AVC, etc. A fallback mechanism is provided for unlisted event types. Occasionally new types are added to the kernel, but not too often. Add a simple "test", which simply prints the mapping.