0.8.2
- Update documentation
- Handle user space audit events in more uniform way
- Update all parsers for more robustness with new kernel changes
- Create quiet mode for error messages
- Make rotated logs readonly

0.8.1
- Fix code to "or" uid  & gid checks for ausearch -ua & -ga
- Change msg() to audit_msg() to avoid conflicts
- Parse socket messages for hostname in ausearch

0.8
- ausearch fix bugs related to -f & -x
- Parse messages using new types
- Properly unescape filenames
- Update interface for sending userspace messages to use more types

0.7.4
- Make sure ausearch ts & te obey DST.
- Code cleanups to make file system watches work correctly

0.7.3
- Add code to get watch list to auditctl
- Get -f & -hn working in ausearch
- Added search by terminal, exe, and syscall to ausearch program
- Added -w parameter to match whole word in ausearch

0.7.2
- Allow ausearch uid & gid to be non-numeric (root, wheel, etc)
- Fix problems with changing run level
- Added new code for logging shutdown reason credentials
- Update DAEMON messages to use better timestamp
- Fixed netlink error handling issues

0.7.1
- Make sure time calc is done using localtime
- Raise rlimits for file size & cpu usage
- Added new disk_error_action config item to auditd.conf
- Rework memory management of event buffer
- Improved error handling in event logging thread

0.7
- In auditctl -l, loop until all rules are printed
- Update autrace not to run if rules are currently loaded
- Added code to switch to single user mode when disk is full
- Added the ausearch program

0.6.12
- Fixed bug where elf type wasn't being set when given numerically
- Added autrace program (similar to strace)
- Fixed bug when logs = 2 and ROTATE is the action, only 1 log resulted

0.6.11
- Check log file size on start up
- Added priority_boost config item
- Reworked arch support
- Reworked how run level is changed
- Make allowances for ECONNREFUSED.

0.6.10
- Code cleanups
- Support the arch field for auditctl
- Add version to auditctl
- Documentation updates
- Moved default location of the audit log to /var/log/audit

0.6.9
- Added filesystem watch patch from Tim Chavez
- Added version information to audit start message
- Change netlink code to use ack in order to get error notification

0.6.8
- Removed pam_loginuid - it now lives in pam
- Removed login and logout message functions

0.6.7
- Fixed bug setting loginuid.
- Added num_logs to configure number of logs when rotating
- Added code for rotating logs

0.6.6
- Fix audit_set_pid to try to read a reply, but its non-fatal if no reply.
- Remove the read status during init
- Change to using pthreads sync mechanism for stopping system
- Worker thread should ignore all signals
- Change main loop to use select for inbound event handling
- Gave pam_loginuid a "failok" option for testing

0.6.5
- Lots of code cleanups
- Added write_pid function to auditd
- Added audit_log to libaudit
- Don't check file length in foreground mode of auditd
- Added *if_enabled functions to send messages only if audit system is enabled
- If syscall name is unknown when printing rules, use the syscall number
- Rework the build system to produce singly threaded public libraries
- Create a multithreaded version of libaudit for the audit daemon's use

0.6.4
- Rename pam_audit to pam_loginuid to reflect what it does
- Fix bug in detecting space left on partition
- Fix bug in handling of suspended logging

0.6.3
- Change pam_audit to write loginuid to /proc/pid/loginuid
- Add pam_session_close handle
- Update to newest kernel headers

0.6.2
- Add R option to auditctl to allow reading rules from file.
- Do not allow task creation list to have syscall auditing
- Add D option to allow deleting all rules with 1 command
- Added pam_audit man page & sample.rules
- Mod initscript to call auditctl to load rules at start-up
- Write message to log file for daemon start up
- Write message that daemon is shutting down
- Modify auditd shutdown to wait until logger thread is finished
- Add sample rule file to docs 

0.6.1
- Lots of code cleanups in auditctl
- Added admin_space_left & admin_space_left_action items
- Reworked the man page for auditctl to make it easier to use.

0.6
- Add disk full and low disk space detection and handling routines
- Add max log file size detection and handling routines
- Add raw log format routine

0.5.6
- Change the makefile so that a shared object file is created.
- Added auditd.conf man page. 

0.5.5
- Adjust start & stop priorities of initscript
- Remove call to sysctl in the initscript since there are none
- Add config parser and initial config file
- Restructure consumer thread and rename to event thread

0.5.4
- Attempt to set loginuid in pam module
- Beginnings of config parser
- New man pages

0.5.3
- Restructure project files.
- Lots of code clean ups
- lib directory is now under LGPL

0.5.2
- make auditd behave as a daemon. 
- Added signal handler for SIGTERM

0.5.1
- Major reworking
