Glossary
Audit stage
The point in handling an API request at which a Kubernetes audit event is emitted: RequestReceived, ResponseStarted, ResponseComplete or Panic.
One Kubernetes API request can produce several audit events, one per stage: RequestReceived (as soon as the request arrives), ResponseStarted (headers sent, only for long-running requests such as watch, exec, attach and port-forward), ResponseComplete (response finished) and Panic (the handler crashed).
All events of one request share the same auditID, so count requests on that field, not on lines. Most policies omit RequestReceived with omitStages. For an exec session, ResponseStarted marks when the shell opened. See the anatomy of an audit event.