.on(end) event, a little better auditd parsing