Audit Parsing Library Requirements

[Steve Grubb]

On Friday 10 March 2006 15:38, Steve Grubb wrote:
> For example, root change bob's
> account password. search for uid=bob will hit on the password change event
> since bob's account is what's being manipulated.

Actually, this is bad example since I don't think it happens for this message. 
There's only 1 or 2 messages that do this and I don't remember what they are 
other than user space. But we do favor the uid later in the message under the 
current scheme.

-Steve