Ruby to parse EXECVEs from audispd into something that looks like a shell session.

parse_audisps

#!/usr/bin/env ruby

def time(tokens)
  if tokens.first =~ /^\d+-\d+-\d+T/
    tokens.first
  else
    tokens[0..2].join(' ')
  end
end

while gets do
  case $_
  when /EXECVE/ then
    tokens = $_.split

    STDOUT.write time(tokens), ' '

    wack = tokens.map do |stringy|
      match = /^a(\d+)=(.*)/.match(stringy)
      next nil unless match

      argnum = match[1]
      argument = match[2]

      if Integer(argnum) == 0
        argument.sub!(/^"/,'')
        argument.sub!(/"$/,'')
      end
      argument
    end.compact

    puts wack.join(' ')
  end
end