Things that need to be done:
===========================
0.9.2
Check for duplicate file & exe while matching in ausearch - rename could have 2 path records & may need to do linked list matching for strings
Revisit whether sighup makes sense

1.0
Handle fragmented audit events - glue all records back together in ausearch

1.1
Allow users to label syscall event rules in auditctl
Pretty Print ausearch messages
Add scheduling options: strict, relaxed, loose (determines user space queueing)
Add exec option to action handlers
Parser should allow more than 1 arg after option - eg EXEC /usr/local/script
Add config option media: syslog, file, socket, dbus
Allow users to specify message types to be kept for logging
Allow users to specify fields to be kept for logging - kernel work
Add rotate on startup option.
Remove evil getopt cruft in auditctl

1.?
Look into preventing duplicate rules 
Consider creating way to interactively delete rules by menu
Create a rule builder GUI
Look at adding XML & binary formats
