Things that need to be done:
===========================
1.1
Remove deprecated functions
drop translate option in auditctl
Bump so number
audit dispatcher program & plugin framework
auditctl label support
add support for new operators

1.2
more plugins
look at config changed report to see if an action can be added 
Add scheduling options: strict, relaxed, loose (determines user space queueing)
Add exec option to action handlers
Parser should allow more than 1 arg after option - eg EXEC /usr/local/script
Add config option media: syslog, file, socket, dbus
auditctl session id, pgid
aureport get specific reports working

1.3
Look at adding XML & binary formats
Remove evil getopt cruft in auditctl
Add counting semaphore to control internal queue depth
auditctl should ignore invalid arches for rules
Add rotate on startup option.
Look at modifying rule matcher to do: first match & match all 

1.4
Pretty Print ausearch messages
make ausearch library for third party parsing API
Allow users to specify message types to be kept for logging
Allow users to specify fields to be kept for logging

1.5
audit explorer gui
create responder to potential security incidents
Under what circumstances do files have relative name in path record - ausearch may have to combine cwd record with path to do file searches

IN THE DISTANT FUTURE:
Allow users to label syscall event rules in auditctl
Consider creating way to interactively delete rules by menu
Create a rule builder GUI
