Things that need to be done:
===========================
1.3.1 - parse library
* Group message types in ausearch help.
* Put message types into ternary or avl tree for ausearch/aureport use
* subj & obj of ipsec records
* look at emitting event in pipe mode when 5 clock seconds has passed and nothing new has been read
* add more man pages
* Add subject information to audit internal messages
* Decode ioctl calls - Xen
* Search by op ausearch
* Fix aureport-scan to properly decide if CONFIG_CHANGE is add or del

1.3.2 - parse library
* Bump soname number ???
* Look at variadic avc logging patch 
* Change python to allow NULL param passing
* Switch auditctl over to use only new rule structs
* Remove all old rule structs
* Consolidate parsing code between libaudit and auditd-conf.c
* If relative file in cwd, need to build also (realpath). watch out for (null) and socket
* Change ausearch to output name="" unless its a real null. (mount) ausearch-report.c, 523. FIXME
* Changes in uid/gid, failed changes in credentials in aureport
* Add aureport report giving login time ranges for a user
* Add exec option to action handlers
* Parser should allow more than 1 arg after option - eg EXEC /usr/local/script

1.4 - event dispatcher
* Don't audit the audispd program
* More audit dispatcher program & plugin framework updates
more plugins
* aureport get specific reports working
* Add keywords for time: last-boot, last-load, last-relabel.
* create responder to potential security incidents
* Sessions for logins - all events in same session ausearch

1.5
auditctl session id, pgid
Add counting semaphore to control internal queue depth
auditctl should ignore invalid arches for rules
Look at supporting binary formats
Remove evil getopt cruft in auditctl

1.6
Add scheduling options: strict, relaxed, loose (determines user space queueing)
Add config option media: syslog, file, socket, dbus
Allow users to specify message types to be kept for logging
Allow users to specify fields to be kept for logging

1.7
Pretty Print ausearch messages
audit explorer gui

IN THE DISTANT FUTURE:
Look at modifying kernel rule matcher to do: first match & match all 
Consider creating way to interactively delete rules by menu
Create a rule builder GUI
