fluentd + auditd

fluent.conf

<source>
  type tcp
  port 9881
  tag audit
  time_format %s
  format /(^type=AVC msg=audit\((?<time>\w+).*: apparmor=\"(?<resolution>\w+)\" operation=\"(?<operation>\w+)\"( profile=\"(?<profile>[^ ]+)\"){0,1}( name=\"(?<name>[^ ]+)\"){0,1} pid=(?<pid>\d+) comm=\"{0,1}(?<comm>[^ ]+)\"{0,1}( requested_mask=\"(?<requested_mask>\w+)\" denied_mask=\"(?<denied_mask>\w+)\" fsuid=(?<fsuid>\d+))?|^type=(?<type>\w+) msg=audit\((?<time>\w+).*: pid=(?<pid>\d+) uid=(?<uid>\d+) .* msg='(?<message>.*)'|type=NETFILTER_CFG msg=audit\((?<time>\w+).*: table=(?<table>[^ ]+) family=(?<family>\d+) entries=(?<entries>\d+)|type=ANOM_PROMISCUOUS msg=audit\((?<time>\w+).*: dev=(?<device>[^ ]+) prom=(?<prom>\d+) old_prom=(?<old_prom>\d+).*)|type=DAEMON\w+ msg=audit\((?<time>\w+).*: (?<message>.*)|type=CONFIG_CHANGE msg=audit\((?<time>\w+).*: (?<message>.*)/
</source>