• In auditd, release the async flush lock on stop
• Don't allow auditd to log directly into /var/log when log_group is non-zero
• Cleanup krb5 memory leaks on error paths
• Update auditd.cron to use auditctl --signal
• In auparse, if too many fields, realloc array bigger (Paul Wolneykien)
• In auparse, special case kernel module name interpretation
• If overflow_action is ignore, don't treat as an error