diff -ur audit-0.6/lib/libaudit.c audit-0.5.7/lib/libaudit.c
--- audit-0.6/lib/libaudit.c	2005-01-05 09:27:38.033419776 -0500
+++ audit-0.5.7/lib/libaudit.c	2005-01-05 09:16:11.000000000 -0500
@@ -19,6 +19,8 @@
  * Authors:
  *      Rickard E. (Rik) Faith <faith@redhat.com>
  *      Steve Grubb <sgrubb@redhat.com>
+ *      Debora Velarde <dvelarde@us.ibm.com> added deb_format_text function	
+ *        and supporting put functions based on Klaus Weidner's example functions
  */
 
 #include <stdio.h>
@@ -361,3 +363,286 @@
         return buf;	
 }
 
+/*
+* This function will take an audit structure and return a
+* text buffer formatted for writing to disk. If there is an error
+* the return value is NULL. It is the caller's responsibility
+* free the formatted buffer.
+*/
+const char *format_text(const struct audit_reply *rep)
+{
+
+	char *buf=NULL;
+	char *save_buf=NULL;
+	int max_buf=8192; //8K
+	int len=0;
+	unsigned int i;
+	int putsize=0;
+
+	if (rep==NULL)
+		return NULL;
+
+	buf=malloc((max_buf)*sizeof(char));
+	if (buf==NULL)
+		return NULL;
+
+	save_buf=buf;
+
+	putsize=(strlen("event="))*(sizeof(char));
+	snprintf(buf, putsize+1, "event=");
+	buf+=putsize;
+
+    switch (rep->type) {
+	case AUDIT_GET:
+		buf=put_struct(buf,
+			"msg_type", T_keyword, "GET",
+			"seq", T_integer, rep->nlh->nlmsg_seq,
+			"message", T_string, "AUDIT_STATUS"
+			"enabled", T_integer, rep->status->enabled,
+			"failure", T_integer, rep->status->failure,
+			"pid", T_integer, rep->status->pid,
+			"rate_limit", T_integer, rep->status->rate_limit,
+			"backlog_limit", T_integer, rep->status->backlog_limit,
+			"lost", T_integer, rep->status->lost,
+			"backlog", T_integer, rep->status->backlog,
+			(char*)0
+		);
+		return save_buf;
+	case AUDIT_SET:
+		if (rep->status->mask & AUDIT_STATUS_ENABLED) {
+			buf=put_struct(buf,
+				"msg_type", T_keyword, "SET",
+				"seq", T_integer, rep->nlh->nlmsg_seq,
+				"enabled", T_integer, rep->status->enabled,
+				(char*)0
+			);
+		}
+		if (rep->status->mask & AUDIT_STATUS_FAILURE) {
+			buf=put_struct(buf,
+				"msg_type", T_keyword, "SET",
+				"seq", T_integer, rep->nlh->nlmsg_seq,
+				"failure", T_integer, rep->status->failure,
+				(char*)0
+			);
+		}
+		if (rep->status->mask & AUDIT_STATUS_PID) {
+			buf=put_struct(buf,
+				"msg_type", T_keyword, "SET",
+				"seq", T_integer, rep->nlh->nlmsg_seq,
+				"pid", T_integer, rep->status->pid,
+				(char*)0
+			);
+		}
+		if (rep->status->mask & AUDIT_STATUS_RATE_LIMIT) {
+			buf=put_struct(buf,
+				"msg_type", T_keyword, "SET",
+				"seq", T_integer, rep->nlh->nlmsg_seq,
+				"rate_limit", T_integer, rep->status->rate_limit,
+				(char*)0
+			);
+		}
+		if (rep->status->mask & AUDIT_STATUS_BACKLOG_LIMIT) {
+			buf=put_struct(buf,
+				"msg_type", T_keyword, "SET",
+				"seq", T_integer, rep->nlh->nlmsg_seq,
+				"backlog_limit", T_integer, rep->status->backlog_limit,
+				(char*)0
+			);
+		}
+		if (rep->status->mask & AUDIT_STATUS_BACKLOG_LIMIT) {
+			buf=put_struct(buf,
+				"msg_type", T_keyword, "SET",
+				"seq", T_integer, rep->nlh->nlmsg_seq,
+				"backlog_limit", T_integer, rep->status->backlog_limit,
+				(char*)0
+			);
+		}
+		return save_buf;
+	case AUDIT_ADD:
+		buf=put_struct(buf,
+			"msg_type", T_keyword, "ADD",
+			"seq", T_integer, rep->nlh->nlmsg_seq,
+			"flags", T_string, audit_flag_to_name(rep->rule->flags),
+			"action", T_string, audit_action_to_name(rep->rule->action),
+			(char*)0
+		);
+		return save_buf;
+	case AUDIT_DEL:
+		buf=put_struct(buf,
+			"msg_type", T_keyword, "DEL",
+			"seq", T_integer, rep->nlh->nlmsg_seq,
+			"flags", T_string, audit_flag_to_name(rep->rule->flags),
+			"action", T_string, audit_action_to_name(rep->rule->action),
+			(char*)0
+		);
+		return save_buf;
+	case AUDIT_LIST:
+		buf=put_struct(buf,
+			"msg_type", T_keyword, "LIST",
+			"seq", T_integer, rep->nlh->nlmsg_seq,
+			"flags", T_string, audit_flag_to_name(rep->rule->flags),
+			"action", T_string, audit_action_to_name(rep->rule->action),
+			(char*)0);
+		return save_buf;
+	case AUDIT_USER:
+		buf=put_struct(buf,
+			"msg_type", T_keyword, "USER",
+			"seq", T_integer, rep->nlh->nlmsg_seq,
+			"len", T_integer, rep->len,
+			"message", T_string, rep->message,
+			(char*)0
+		);
+		return save_buf;
+	case AUDIT_KERNEL:
+// FIXME: This may not be sufficient. There are: avc, syscall, item,
+// audit_enabled, and probably more subtypes. These need to be broken down if
+// we want to change syscall numbers to the function name, filter avc's, etc.
+		buf=put_struct(buf,
+			"msg_type", T_keyword, "KERNEL",
+			"seq", T_integer, rep->nlh->nlmsg_seq,
+			"len", T_integer, rep->len,
+			"message", T_string, rep->message,
+			(char*)0
+		);
+		return save_buf;
+	case AUDIT_LOGIN:
+		buf=put_struct(buf,
+			"msg_type", T_keyword, "LOGIN",
+			"seq", T_integer, rep->nlh->nlmsg_seq,
+			"len", T_integer, rep->len,
+			"message", T_string, rep->message,
+			(char*)0
+		);
+		return save_buf;
+	default:
+		buf=put_struct(buf,
+			"msg_type", T_keyword, "UNKNOWN",
+			"seq", T_integer, rep->nlh->nlmsg_seq,
+			(char*)0
+		);
+		return save_buf;
+	}
+	return save_buf;
+}
+
+/* Supporting put functions */
+
+char * put_escaped_string(char *buf, const char *txt)
+{
+		for (;*txt;++txt) {
+			switch(*txt) {
+            case '\n':
+				snprintf(buf, (sizeof(char))+1,"%c", '\\');	
+				buf+=(sizeof(char));
+				snprintf(buf, (sizeof(char))+1,"%c", 'n');	
+				buf+=(sizeof(char));
+               	break;
+			case '\t':
+				snprintf(buf, (sizeof(char))+1, "%c", '\\');	
+				buf+=(sizeof(char));
+				snprintf(buf, (sizeof(char))+1, "%c", 't');	
+				buf+=(sizeof(char));
+                break;
+			case '\'':
+			case '\\':
+				snprintf(buf, (sizeof(char))+1, "%c", '\\');	
+				buf+=(sizeof(char));
+				snprintf(buf, (sizeof(char))+1, "%c", *txt);	
+				buf+=(sizeof(char));
+				break;
+			default:
+            	if (*txt<32) {
+					// printf("DEBUG: special char under 32\n");
+					snprintf(buf, (sizeof(*txt))+1, "\\%03o", *txt);
+					buf+=(sizeof(*txt));
+				} else {
+					snprintf(buf, (sizeof(char))+1, "%c", *txt);	
+					buf+=(sizeof(char));
+				}
+            }
+        }
+	return buf;
+}
+
+char *put_integer(char *buf, int val)
+{
+
+	int num=0;
+	int putsize=0;
+
+	num=sprintf(buf, "%d", val);
+	if (num<0)
+		return NULL;
+
+	buf+=(num*(sizeof(char)));
+	return buf;
+}
+
+char *put_keyword(char *buf, const char *val)
+{
+	for (;*val;++val) {
+		snprintf(buf, (sizeof(char))+1,"%c", *val);
+		buf+=(sizeof(char));
+	}
+	return buf;
+}
+
+char *put_string(char *buf, const char *val)
+{
+	int putsize=0;
+
+	putsize=(sizeof(char));
+	snprintf(buf, putsize+1, "%c", '\'');	
+	buf+=putsize;
+	buf=put_escaped_string(buf, val);
+	snprintf(buf, putsize+1, "%c", '\'');	
+	buf+=putsize;
+
+	return buf;
+}
+
+
+char *put_struct(char *buf, ...)
+{
+	char *save_buf;
+	va_list ap;
+	va_start(ap, buf);
+	int putsize=0;
+
+	save_buf=buf;
+	putsize=(sizeof(char));
+	snprintf(buf, putsize+1, "%c", '{');
+	buf+=putsize;
+
+	while(1) {
+		const char *name;
+		int type;
+
+		name = va_arg(ap, const char*);
+		if (!name) break;
+
+		buf=put_string(buf, name);
+		putsize=(sizeof(char));
+		snprintf(buf, putsize+1, "%c", '=');
+		buf+=putsize;
+		type = va_arg(ap, int);
+		if (type==T_integer) {
+			buf=put_integer(buf, va_arg(ap, int));
+		} else if(type==T_keyword) {
+			buf=put_keyword(buf, va_arg(ap, const char*));
+		} else if(type==T_string) {
+			buf=put_string(buf, va_arg(ap, const char*));
+		}
+		snprintf(buf, putsize+1, "%c", ' ');
+		buf+=putsize;
+        }
+
+        va_end(ap);
+
+	snprintf(buf, putsize+1, "%c", '}');
+	buf+=putsize;
+	snprintf(buf, putsize+1, "%c", ' ');
+	buf+=putsize;
+
+	return save_buf;
+}
diff -ur audit-0.6/lib/libaudit.h audit-0.5.7/lib/libaudit.h
--- audit-0.6/lib/libaudit.h	2005-01-05 09:28:02.990625704 -0500
+++ audit-0.5.7/lib/libaudit.h	2005-01-05 09:16:11.000000000 -0500
@@ -121,6 +121,13 @@
 /* Other helper functions */
 extern int  audit_print_reply(struct audit_reply *rep);
 extern const char *format_raw(const struct audit_reply *rep);
+extern const char *format_text(const struct audit_reply *rep);
+/* Printing functions */
+extern char *put_escaped_string(char* buf, const char *txt);
+extern char *put_integer(char *buf, int val);
+extern char *put_keyword(char *buf, const char *val);
+extern char *put_string(char *buf, const char *val);
+extern char *put_struct(char *buf, ...);
 extern void test_print(char *buf);
 
 
diff -ur audit-0.6/src/auditd-config.c audit-0.5.7/src/auditd-config.c
--- audit-0.6/src/auditd-config.c	2005-01-05 09:29:57.307246936 -0500
+++ audit-0.5.7/src/auditd-config.c	2005-01-05 09:16:11.000000000 -0500
@@ -92,7 +92,7 @@
 static const struct nv_list log_formats[] =
 {
   {"raw",  LF_RAW },
-//  {"text", LF_TEXT },
+  {"text", LF_TEXT },
   { NULL,  0 }
 };
 
diff -ur audit-0.6/src/auditd-event.c audit-0.5.7/src/auditd-event.c
--- audit-0.6/src/auditd-event.c	2005-01-05 09:29:20.787798736 -0500
+++ audit-0.5.7/src/auditd-event.c	2005-01-05 09:16:11.000000000 -0500
@@ -190,9 +190,9 @@
 			case LF_RAW:
 				buf = format_raw(&data->head->reply);
 				break;
-//			case LF_TEXT:
-//				buf=format_text(&data->head->reply);
-//				break;
+			case LF_TEXT:
+				buf=format_text(&data->head->reply);
+				break;
 			default:
 				msg(LOG_ERR, "Illegal log format detected %d", 
 					data->config->log_format);
