diff --git a/usr.sbin/praudit/tests/input/del_comma b/usr.sbin/praudit/tests/input/del_comma
--- a/usr.sbin/praudit/tests/input/del_comma
+++ b/usr.sbin/praudit/tests/input/del_comma
@@ -2,6 +2,6 @@
 argument,1,0x1c,domain
 argument,2,0x2,type
 argument,3,0x0,protocol
-subject,root,root,wheel,root,0,7053,4724,37636,10.0.2.2
+subject,root,root,wheel,root,wheel,7053,4724,37636,10.0.2.2
 return,success,3
 trailer,113
diff --git a/usr.sbin/praudit/tests/input/del_underscore b/usr.sbin/praudit/tests/input/del_underscore
--- a/usr.sbin/praudit/tests/input/del_underscore
+++ b/usr.sbin/praudit/tests/input/del_underscore
@@ -2,6 +2,6 @@
 argument_1_0x1c_domain
 argument_2_0x2_type
 argument_3_0x0_protocol
-subject_root_root_wheel_root_0_7053_4724_37636_10.0.2.2
+subject_root_root_wheel_root_wheel_7053_4724_37636_10.0.2.2
 return_success_3
 trailer_113
diff --git a/usr.sbin/praudit/tests/input/no_args b/usr.sbin/praudit/tests/input/no_args
--- a/usr.sbin/praudit/tests/input/no_args
+++ b/usr.sbin/praudit/tests/input/no_args
@@ -2,6 +2,6 @@
 argument,1,0x1c,domain
 argument,2,0x2,type
 argument,3,0x0,protocol
-subject,root,root,wheel,root,0,7053,4724,37636,10.0.2.2
+subject,root,root,wheel,root,wheel,7053,4724,37636,10.0.2.2
 return,success,3
 trailer,113
diff --git a/usr.sbin/praudit/tests/input/numeric_form b/usr.sbin/praudit/tests/input/numeric_form
--- a/usr.sbin/praudit/tests/input/numeric_form
+++ b/usr.sbin/praudit/tests/input/numeric_form
@@ -2,6 +2,6 @@
 argument,1,0x1c,domain
 argument,2,0x2,type
 argument,3,0x0,protocol
-subject,root,root,wheel,root,0,7053,4724,37636,10.0.2.2
+subject,root,root,wheel,root,wheel,7053,4724,37636,10.0.2.2
 return,success,3
 trailer,113
diff --git a/usr.sbin/praudit/tests/input/same_line b/usr.sbin/praudit/tests/input/same_line
--- a/usr.sbin/praudit/tests/input/same_line
+++ b/usr.sbin/praudit/tests/input/same_line
@@ -1 +1 @@
-header,113,11,socket(2),0,Mon Jun 11 10:18:45 2018, + 380 msec,argument,1,0x1c,domain,argument,2,0x2,type,argument,3,0x0,protocol,subject,root,root,wheel,root,0,7053,4724,37636,10.0.2.2,return,success,3,trailer,113,
+header,113,11,socket(2),0,Mon Jun 11 10:18:45 2018, + 380 msec,argument,1,0x1c,domain,argument,2,0x2,type,argument,3,0x0,protocol,subject,root,root,wheel,root,wheel,7053,4724,37636,10.0.2.2,return,success,3,trailer,113,
diff --git a/usr.sbin/praudit/tests/input/short_form b/usr.sbin/praudit/tests/input/short_form
--- a/usr.sbin/praudit/tests/input/short_form
+++ b/usr.sbin/praudit/tests/input/short_form
@@ -2,6 +2,6 @@
 argument,1,0x1c,domain
 argument,2,0x2,type
 argument,3,0x0,protocol
-subject,root,root,wheel,root,0,7053,4724,37636,10.0.2.2
+subject,root,root,wheel,root,wheel,7053,4724,37636,10.0.2.2
 return,success,3
 trailer,113
diff --git a/usr.sbin/praudit/tests/input/xml_form b/usr.sbin/praudit/tests/input/xml_form
--- a/usr.sbin/praudit/tests/input/xml_form
+++ b/usr.sbin/praudit/tests/input/xml_form
@@ -4,7 +4,7 @@
 <argument arg-num="1" value="0x1c" desc="domain" />
 <argument arg-num="2" value="0x2" desc="type" />
 <argument arg-num="3" value="0x0" desc="protocol" />
-<subject audit-uid="root" uid="root" gid="wheel" ruid="root" rgid="0" pid="7053" sid="4724" tid="37636 10.0.2.2" />
+<subject audit-uid="root" uid="root" gid="wheel" ruid="root" rgid="wheel" pid="7053" sid="4724" tid="37636 10.0.2.2" />
 <return errval="success" retval="3" />
 </record>
 <?xml version='1.0' ?>