CDC version 5.3.0
When dzdo/sudo is under auditing and the command output is piped, user will found some key inputs not appear in the export TXT session generated by Audit Analyzer.
The missing keystroke is because of a bug in cdash.
In cdash's event loop, it will check stdout, stdin, dev_tty and stderr file descriptors one by one. In this bug, when user press a key input, it looks like both stdin and dev_tty will be triggered and they share the same kernel buffer even though they have different file descriptor number. After cdash see the stdin event and read the stdin data, it continues and sees dev_tty event and tries to read from it. However, as data is read by stdin already, the read() call blocks.
The fix is to continue the loop after successfully reading from the file descriptors.
This is fixed in Suite 2016