It seems that for any given "event" that auditd picks up, there are on the order of four log lines added to the auditd log.
Is there any predictable pattern that can be used to group log file lines into a single event? Specifically, I'm looking for something that denotes the start and end of an event.
For example, it seems like "type=SYSCALL" denotes the start of an event. But auditd docs I've found show that there are a ton -- a ton, I tell ya -- of different record types and the implication to me is that "SYSCALL" might not always be the indicator of an event.
Even more specifically, I'm asking this because I am using Sumologic to analyze my logs and they have a regex-based way of grouping multi-line log data into a single event. I will be asking them this question as well, but since this is more a question about auditd than it is about Sumologic, I thought it would be useful to ask to this community.