Using OSSEC to parse auditd logs