Audit format utility

Hello, I have been doing some thinking about allowing user defined formats to be declared as a parameter to ausearch. Before I commit to that, I thought it might be interesting to create a "mockup". I have placed a utility here: http://people.redhat.com/sgrubb/files/auformat.tar.gz Just untar it and run make. $ ./auformat Usage: auformat <format-string> [path-to-log] --fill What this means is that you can give it a path to a file. If you don't do that, it will read from stdin. Then it will output the fields that you specify. To specify fields start with a % and then put the name as seen in logs. A couple examples: %auid %pid %path %exe This will dump the raw value. But suppose you wanted the interpreted values? Tell it to interpret by giving uppercase: %AUID %SYSCALL %RES %PATH Not all events have all fields. By default it will emit a message to stderr about this. But, you can give it --fill which will print "(none)" in that case. So, a use might be: # ausearch --start today -m login --raw | ~sgrubb/test/auformat/auformat "%time %AUID %ses %RES\n" The app also has 4 virtual field names: date, time, milli, serial. These relate to the event timestamp which you couldn't specify any other way. In any event, I am putting this out to see what people think. -Steve