Things that need to be done:
===========================
0.9.8
Look for memory leak
Add command to request file attr changes to auditctl
Under what circumstances do files have relative name in path record - ausearch may have to combine cwd record with path to do file searches

1.5
Add scheduling options: strict, relaxed, loose (determines user space queueing)
Add exec option to action handlers
Parser should allow more than 1 arg after option - eg EXEC /usr/local/script
Add config option media: syslog, file, socket, dbus
auditctl trigger on context
auditctl session id, pgid
ausearch on context
make ausearch library for third party parsing API
Add counting semaphore to control internal queue depth

1.6
Look at adding XML & binary formats
Remove evil getopt cruft in auditctl
Pretty Print ausearch messages
Allow users to specify message types to be kept for logging
Allow users to specify fields to be kept for logging
Add rotate on startup option.

IN THE DISTANT FUTURE:
Allow users to label syscall event rules in auditctl
Look into preventing duplicate rules 
Consider creating way to interactively delete rules by menu
Create a rule builder GUI
