adding parsing for normal audit.log ... before this, only remote syslog + audit.log was parsing