python parse-tail for audit