getting started
parsing auditd messages