Should open syscall records occur without a path record?

[Steve Grubb]

On Monday 23 July 2007 15:41:31 John D. Ramsdell wrote:
> I bet
> I can quickly write some script that interchanges adjacent audit
> records that are out of order in the raw logs, so as to allow me to
> proceed.  If someone else has a record sorter, please send it along.

setroubleshoot is written in python and it sorts its input stream to solve 
this in the mean time. You might look there for some example code.

-Steve