This summaries multiple lines of the audit log file nicely, but it
is not clear if it will satisfy the auditor's since there is not
connection to the original user for users that login using kerberos
to gain root access to the system.