[PATCH] ausearch: Add checkpoint capability and have incomplete logs carry forward when processing multiple audit.log files

All, Attached is a patch for review. It is against revision 829 within http://svn.fedorahosted.org/svn/audit This patch - allows ausearch to checkpoint itself, in that, successive invocations will only display new events. This is enabled via the --checkpoint fn option. The mods to ausearch.8 describe the method of achieving this. - fixes a minor annoyance/bug in that, when ausearch processes events from multiple audit.log files, incomplete events are considered as complete (and hence printed) when ausearch encounters an EOF on input from all the log files being processed. Now, ausearch only flushes incomplete events on the last log file being processed. Regards Burn Alting