[389-users] Audit log parsing