oh, no question. auditd's tendency to split up long messages makes it almost useless for automated monitoring of certain kinds of activity. (without too much programming to make it worthwhile)