Cooked audit log format

As recently mentioned, Linux audit logs[1] are fairly hideous, and although machine readability may have been a design goal, I'd argue they're not too friendly in that regard either. I suspect, in fact, that the principal driver has been machine producability ;) I've noticed that a number of utilities cook the logs slightly. I've shied away from this to date because I want to be able to leverage existing tools. However, if some standard emerged (or has emerged and I missed it) for cooked logs, I'd be extremely interested in implementing that. Simple starters would include: * Translating the architecture and syscall names into human. * Jumping one way or the other with the hex strings business. * Translating socket addresses into human. * Translating timestamps into human. * Ditching uninteresting records, such as PATH with no name for the dynamic linker, and 2 PATH records when execing a script. with an ultimate goal of: * Defining an expected set of data for every system call and putting them all on a single line in a well defined format. Is anybody doing any work in this direction? Matt [1] Of course, they're really accounting logs produced by the accounting daemon. If you actually audit your accounting logs, this seemingly pedantic point can become quite confusing. -- Matthew Booth, RHCA, RHCSS Red Hat, Global Professional Services M: +44 (0)7977 267231 GPG ID: D33C3490 GPG FPR: 3733 612D 2D05 5458 8A8A 1600 3441 EA19 D33C 3490