a2o/snoopy — pull request #6 by renard (2014-01-08 23:57:48+00:00)
Title: Keep original login during the session

Add:
- `starter`: the session initiator (AKA login).
- `euid`
- `gid`: only primary group.
- `egid`

This is useful to track action even after a user change (such as `su` or `sudo`).

For a much simpler analysis, numerical IDs are resolved to their actual text values.

log examples:

````
user@host:~ $ ls
Jan 9 00:37:12 host snoopy[1071]: [starter:user, uid:user euid:user gid:user egid:user sid:1069 tty:/dev/pts/1 cwd:/home/user filename:/bin/ls]: ls
`````
`````
user@host:~ $ sudo ls
Jan 9 00:38:30 host snoopy[1072]: [starter:user, uid:user euid:user gid:user egid:user sid:1069 tty:/dev/pts/1 cwd:/home/user filename:/usr/bin/sudo]: sudo ls
Jan 9 00:38:31 host snoopy[1075]: [starter:user, uid:root euid:root gid:root egid:root sid:1069 tty:/dev/pts/1 cwd:/home/user filename:/bin/ls]: ls
`````