John, I'm working on a high-level audit reading Python library built on top of the auparse module. I suspect it could be made to be useful to others besides myself. I have enclosed the generated documentation for the relevant classes in my module. If you think it could be generally useful, the key question is what methods should be defined in the AuditEvent and AuditRecord classes. Some of the current ones are too specific to my needs. CLASSES class AuditEvent(__builtin__.list) | AuditEvent(AuEvent) | | An audit event is represented as a list of AuditRecord's. Each | AuditRecord is a dictionary that represents one of the records | that make up the event. | | Method resolution order: | AuditEvent | __builtin__.list | __builtin__.object | | Methods defined here: | | __init__(self, timestamp) | | find_record_of_type(self, typ) | Find record of type | | Returns a record in the event that has the given type. | Returns None when there is no such record. | | find_value(self, name) | Find a value | | Returns a value associated with the given name in some record | in the event. Raises KeyError if no field has the given name. | | get_timestamp(self) | Get the timestamp associated with this event. | | path_name(self, item) | Find name and security context in PATH record | | Return the name and the security context in a PATH record that | matches the given item number. Raises KeyError if PATH record | cannot be found. | | ---------------------------------------------------------------------- | Data descriptors defined here: | | __dict__ | dictionary for instance variables (if defined) | | __weakref__ | list of weak references to the object (if defined) | | ---------------------------------------------------------------------- | Methods inherited from __builtin__.list: !!! inherited methods omitted !!! class AuditLog(__builtin__.object) | AuditLog(AuParser or file, bool) | | Encapsulates a log accessed by the auparse module. It provides an | interator to the log's events. Each call to the next method of | the interator returns an AuditEvent. The boolean determines if | numeric entities in fields are interpreted. | | Methods defined here: | | __init__(self, au, interpret=False) | | __iter__(self) | | ---------------------------------------------------------------------- | Data descriptors defined here: | | __dict__ | dictionary for instance variables (if defined) | | __weakref__ | list of weak references to the object (if defined) class AuditLogIter(__builtin__.object) | AuditLogIter(AuditLog) | | An iterator for an audit log. | | Methods defined here: | | __init__(self, aulog) | | next(self) | Returns an AuditEvent | | ---------------------------------------------------------------------- | Data descriptors defined here: | | __dict__ | dictionary for instance variables (if defined) | | __weakref__ | list of weak references to the object (if defined) class AuditRecord(__builtin__.dict) | AuditRecord(AuditEvent) | | An audit record is a dictionary. | | Method resolution order: | AuditRecord | __builtin__.dict | __builtin__.object | | Methods defined here: | | __init__(self, event) | | get_event(self) | Get the event associated with this record. | | path_name_record(self, item) | Find name and security context in PATH record | | Return the name and the security context in a PATH record that | matches the given item number. Raises KeyError if PATH record | cannot be found. | | ---------------------------------------------------------------------- | Data descriptors defined here: | | __dict__ | dictionary for instance variables (if defined) | | __weakref__ | list of weak references to the object (if defined) | | ---------------------------------------------------------------------- | Methods inherited from __builtin__.dict: !!! inherited methods omitted !!!