Rewrite /etc/passwd parser; add CT number in audit mode; Fix tcp connections parser for support negative hid;