Need to add support for kern.log rotation for swift-drive-audit. There may occur a large miss of information from the time frame specified if kern.log has 'just' rotated. So far all the time stamps matching the time frame, but rotated into kern.log.1 have been ignored.
Also swift-drive-audit seems to be very slow on the large systems, the reason behind it is that the reading of kern.log is done from the beginning to the end, while the significant information is at the end of the file. The idea is to implement feature allowing swift-drive-audit to read from the back of the file, which will also accommodate log roll-over issue.