audit 2.7.2 released

[Steve Grubb]

Hello,

I've just released a new version of the audit daemon. It can be downloaded 
from http://people.redhat.com/sgrubb/audit. It will also be in rawhide
soon. The ChangeLog is:

- Rename whole auparse classifier subsystem to normalizer
- Add documentation about networking and systemd
- Adjust text in auparse normalizer
- In ausearch, fix parsing of kernel anomaly events
- Add filesystem object to the auparse normalizer
- Add basic support for formatted output in ausearch
- Add 'extra' options for csv output in ausearch
- Add event kind metadata to the auparse normalizer
- Add event kind metadata to the ausearch csv format
- Add auparse normalizer support to some anomaly events
- In libaudit logging functions, fill in hostname if we have real tty
- Add new virtualization events
- Fix compile time feature detection in auditctl

In the 2.7.x releases is a big new feature that I have not talked very much 
about. Starting with this release I'll start talking about it. The audit logs 
can now be normalized. This means we can do lots of new things around 
analytics. So much so, that I will send a separate email discussing this new 
feature. I'll also start posting to a blog to explain all the things that you 
can now do. If you have the ability to compile the sources, do it and try 

ausearch --start today --format text

Besides this, the release fixes a bug in parsing of kernel anaomaly events for 
ausearch/report and we added types for some new virtualization events.

I will try to get a 2.7.3 release out in a little under 2 weeks. This is to 
get one last release off of the svn site before it goes away. Testing and 
feedback around the normalizer would be greatly appreciated. As mentioned, 
I'll start another thread to discuss it.

Please let me know if you run across any problems with this release.

-Steve