Decoding of saddr and other values

[whavey]

Does go-audit decode the encoded fields such as saddr, a0, etc...?
If so are there special configuration parameter that need to be set?

[Nate Brown]

go-audit attempts to be as fast as possible and consume as few resources on the host where it is running. I'd recommend looking into logstash-filter-goaudit or streamstash for all your audit log post-processing needs. Here is an example of post-processing locally if you don't have the needs for a complex log house setup.