kunal chandarana wrote: It's kind of hard to answer some of the questions without knowing what type of analysis you'll be doing. But having written some audit analysis code and a backend to store it, here would be my suggestions. * You should be able to search by record type * You should be able to query an event and get all its records, and given a record it should be easy to get to the event it's contained in. * Breaking records into name/value pairs is probably too fine grained. Searching by record type is a good level of granularity. Not all record types have complete name/value pairs or are well formed and regular. * The event id (includes the timestamp) is shared between all records of one event. The serial number of the event id is not all that important, but one should be able to search on the timestamp. * Host information has recently been added. The searching by host will be critical. -- John Dennis <jdennis(a)redhat.com&gt;