2.3.1

Changed

• Reduce heap allocations when parsing and enriching auditd events. #111

Fixed

• Fix change in behaviour that causes error when unmarshaling AuditStatus with a short buffer. #110
• Fix minimum AuditStatus length so that library can support kernels from 2.6.32. #113 #119
• Fix parsing of audit rules where arguments are quoted (like file paths containing spaces). #115