Audit format utility

[Steve Grubb]

Hello,

I have been doing some thinking about allowing user defined formats to be
declared as a parameter to ausearch. Before I commit to that, I thought it
might be interesting to create a "mockup". I have placed a utility here:

http://people.redhat.com/sgrubb/files/auformat.tar.gz

Just untar it and run make.

$ ./auformat 
Usage: auformat <format-string> [path-to-log] --fill

What this means is that you can give it a path to a file. If you don't do that,
it will read from stdin. Then it will output the fields that you specify. To
specify fields start with a % and then put the name as seen in logs. A couple examples:

%auid  %pid  %path  %exe

This will dump the raw value. But suppose you wanted the interpreted values?
Tell it to interpret by giving uppercase:

%AUID  %SYSCALL  %RES  %PATH

Not all events have all fields. By default it will emit a message to stderr
about this. But, you can give it --fill which will print "(none)" in that case.

So, a use might be:

# ausearch --start today -m login --raw | ~sgrubb/test/auformat/auformat "%time %AUID %ses %RES\n"

The app also has 4 virtual field names: date, time, milli, serial. These
relate to the event timestamp which you couldn't specify any other way.

In any event, I am putting this out to see what people think.

-Steve