Module audit_enhanced 

Enhanced audit logging with structured entries, ring buffer, and filtering

Provides a next-generation audit subsystem for VeridianOS with:

• Structured log entries with timestamps, PIDs, TIDs, categories, severity
• Ring buffer storage with configurable capacity (default 8192 entries)
• Multi-dimensional filtering (category, severity, PID, time range)
• Event coalescing for repeated identical events within 1 second
• Thread-safe access via spin::RwLock

This module complements the existing security::audit module by adding richer categorization, severity levels, and query capabilities.

Structs

AuditActiveFilter

Active filter controlling which events are accepted into the log.

AuditEntry

A structured audit log entry.

AuditQueryFilter

Multi-dimensional filter for querying audit events.

EnhancedAuditStats

Statistics for the enhanced audit log.

Enums

AuditCategory

Category of an audit event, enabling fine-grained filtering.

AuditSeverity

Severity level for an audit event.

Functions

clear_log

Clear all audit log entries.

disable

Disable the enhanced audit subsystem.

enable

Enable the enhanced audit subsystem.

get_filter

Get the current active filter.

get_stats

Get audit statistics.

init

Initialize the enhanced audit subsystem.

init_with_capacity

Initialize with a custom capacity.

is_enabled

Check if the enhanced audit subsystem is enabled.

log_auth

Log an authentication event.

log_authz

Log an authorization / access control event.

log_capability

Log a capability operation event.

log_event

Log a structured audit event.

log_file

Log a file access event.

log_network

Log a network access event.

log_policy

Log a security policy change.

log_process

Log a process lifecycle event.

log_syscall

Log a system call audit event.

query_events

Query audit events matching a filter.

set_filter

Set the active filter that controls which events are logged.