Description of problem:
FutureFeature

To better support the centralisation of audit events, we would like ausearch to support the customisation of it's output through configuration.

ausearch is an effective tool to interpret and hence enrich localised numeric entities such as system call names, user identity, etc local audit events prior to their transmission to an independant centralised event repository.

To better support the parsing and stored content in the central repository, we request that ausearch optionally support the ability to customise it's output. For example,
- all date/times are to be generated in configurable forms (epoch, rfc3339, strftime strings)
- all values generated to support embedded ='s either through escaping or surrounding all values in double quotes
- escape or interpret no-printing characters in values
- ensure event records only output single lines (ie translate newlines, carriage returns into \n, \r etc)
- can configure interpreted output dependant on auparse_type (i.e. uid/gid types can return both numeric entity as well as interpreted entity so aid in errant localised account identification).

We can assist in the creation of such modification once a defined set of requirements are agreeed to.

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info: