Change 109311 by rwatson@rwatson_fledge on 2006/11/05 23:30:33

	Support for printing BSM records as XML in praudit.
	
	Reviewed by:	Martin Voros <martin_voros at yahoo dot com>

Affected files ...

... //depot/projects/trustedbsd/openbsm/HISTORY#43 edit
... //depot/projects/trustedbsd/openbsm/README#21 edit
... //depot/projects/trustedbsd/openbsm/TODO#9 edit
... //depot/projects/trustedbsd/openbsm/bin/praudit/praudit.1#12 edit
... //depot/projects/trustedbsd/openbsm/bin/praudit/praudit.c#11 edit
... //depot/projects/trustedbsd/openbsm/bsm/libbsm.h#31 edit
... //depot/projects/trustedbsd/openbsm/libbsm/bsm_io.c#42 edit

Differences ...

==== //depot/projects/trustedbsd/openbsm/HISTORY#43 (text+ko) ====

@@ -3,6 +3,7 @@
 - compat/clock_gettime.h now provides a compatibility implementation of
   clock_gettime(), which fixes building on Mac OS X.
 - Countless man page fixes.
+- praudit XML support via "praudit -x".
 
 OpenBSM 1.0 alpha 12
 
@@ -270,4 +271,4 @@
   to support reloading of kernel event table.
 - Allow comments in /etc/security configuration files.
 
-$P4: //depot/projects/trustedbsd/openbsm/HISTORY#42 $
+$P4: //depot/projects/trustedbsd/openbsm/HISTORY#43 $

==== //depot/projects/trustedbsd/openbsm/README#21 (text+ko) ====

@@ -77,6 +77,7 @@
     Pawel Worach
     Martin Englund
     Ruslan Ermilov
+    Martin Voros
 
 In addition, Coverity, Inc.'s Prevent(tm) static analysis tool and Gimpel
 Software's FlexeLint tool were used to identify a number of bugs in the
@@ -98,4 +99,4 @@
 
     http://www.TrustedBSD.org/
 
-$P4: //depot/projects/trustedbsd/openbsm/README#20 $
+$P4: //depot/projects/trustedbsd/openbsm/README#21 $

==== //depot/projects/trustedbsd/openbsm/TODO#9 (text+ko) ====

@@ -1,4 +1,3 @@
-- Teach praudit how to general XML format BSM streams.
 - Teach libbsm about any additional 64-bit token types that are present
   in more recent Solaris versions.
 - Build a regression test suite for libbsm that generates each token
@@ -20,4 +19,4 @@
 - Put hostname in trail file name.
 - Document audit_warn event arguments.
 
-$P4: //depot/projects/trustedbsd/openbsm/TODO#8 $
+$P4: //depot/projects/trustedbsd/openbsm/TODO#9 $

==== //depot/projects/trustedbsd/openbsm/bin/praudit/praudit.1#12 (text+ko) ====

@@ -25,9 +25,9 @@
 .\" IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
 .\" POSSIBILITY OF SUCH DAMAGE.
 .\"
-.\" $P4: //depot/projects/trustedbsd/openbsm/bin/praudit/praudit.1#11 $
+.\" $P4: //depot/projects/trustedbsd/openbsm/bin/praudit/praudit.1#12 $
 .\"
-.Dd October 3, 2006
+.Dd November 5, 2006
 .Dt PRAUDIT 1
 .Os
 .Sh NAME
@@ -35,7 +35,7 @@
 .Nd "print the contents of audit trail files"
 .Sh SYNOPSIS
 .Nm
-.Op Fl lp
+.Op Fl lpx
 .Op Fl r | s
 .Op Fl d Ar del
 .Op Ar
@@ -77,6 +77,8 @@
 record and event type are displayed.
 This option is exclusive from
 .Fl r .
+.It Fl x
+Print audit records in the XML output format.
 .El
 .Pp
 If the raw or short forms are not specified, the default is to print the tokens

==== //depot/projects/trustedbsd/openbsm/bin/praudit/praudit.c#11 (text+ko) ====

@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2004 Apple Computer, Inc.
+ * Copyright (c) 2006 Martin Voros
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -26,7 +27,7 @@
  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/bin/praudit/praudit.c#10 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bin/praudit/praudit.c#11 $
  */
 
 /*
@@ -34,7 +35,7 @@
  */
 
 /*
- * praudit [-lp] [-r | -s] [-d del] [file ...]
+ * praudit [-lpx] [-r | -s] [-d del] [file ...]
  */
 
 #include <bsm/libbsm.h>
@@ -51,12 +52,14 @@
 static int	 raw = 0;
 static int	 shortfrm = 0;
 static int	 partial = 0;
+static int	 xml = 0;
 
 static void
 usage(void)
 {
 
-	fprintf(stderr, "usage: praudit [-lp] [-r | -s] [-d del] [file ...]\n");
+	fprintf(stderr, "usage: praudit [-lpx] [-r | -s] [-d del] "
+	    "[file ...]\n");
 	exit(1);
 }
 
@@ -88,11 +91,17 @@
 			if (-1 == au_fetch_tok(&tok, buf + bytesread,
 			    reclen - bytesread))
 				break;
-			au_print_tok(stdout, &tok, del, raw, shortfrm);
+			if (xml)
+				au_print_tok_xml(stdout, &tok, del, raw,
+				    shortfrm);
+			else
+				au_print_tok(stdout, &tok, del, raw,
+				    shortfrm);
 			bytesread += tok.len;
-			if (oneline)
-				printf("%s", del);
-			else
+			if (oneline) {
+				if (!xml)
+					printf("%s", del);
+			} else
 				printf("\n");
 		}
 		free(buf);
@@ -109,7 +118,7 @@
 	int i;
 	FILE *fp;
 
-	while ((ch = getopt(argc, argv, "d:lprs")) != -1) {
+	while ((ch = getopt(argc, argv, "d:lprsx")) != -1) {
 		switch(ch) {
 		case 'd':
 			del = optarg;
@@ -135,12 +144,19 @@
 			shortfrm = 1;
 			break;
 
+		case 'x':
+			xml = 1;
+			break;
+
 		case '?':
 		default:
 			usage();
 		}
 	}
 
+	if (xml)
+		au_print_xml_header(stdout);
+
 	/* For each of the files passed as arguments dump the contents. */
 	if (optind == argc) {
 		print_tokens(stdin);
@@ -153,5 +169,9 @@
 		if (fp != NULL)
 			fclose(fp);
 	}
+
+	if (xml)
+		au_print_xml_footer(stdout);
+
 	return (1);
 }

==== //depot/projects/trustedbsd/openbsm/bsm/libbsm.h#31 (text+ko) ====

@@ -26,7 +26,7 @@
  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/bsm/libbsm.h#30 $
+ * $P4: //depot/projects/trustedbsd/openbsm/bsm/libbsm.h#31 $
  */
 
 #ifndef _LIBBSM_H_
@@ -771,6 +771,14 @@
 //XXX The following interface has different prototype from BSM
 void			 au_print_tok(FILE *outfp, tokenstr_t *tok,
 			    char *del, char raw, char sfrm);
+void			 au_print_tok_xml(FILE *outfp, tokenstr_t *tok,
+			    char *del, char raw, char sfrm);
+
+/* 
+ * Functions relating to XML output.
+ */
+void			 au_print_xml_header(FILE *outfp);
+void			 au_print_xml_footer(FILE *outfp);
 __END_DECLS
 
 /*

==== //depot/projects/trustedbsd/openbsm/libbsm/bsm_io.c#42 (text+ko) ====

@@ -2,6 +2,7 @@
  * Copyright (c) 2004 Apple Computer, Inc.
  * Copyright (c) 2005 SPARTA, Inc.
  * Copyright (c) 2006 Robert N. M. Watson
+ * Copyright (c) 2006 Martin Voros
  * All rights reserved.
  *
  * This code was developed in part by Robert N. M. Watson, Senior Principal
@@ -31,7 +32,7 @@
  * IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  * POSSIBILITY OF SUCH DAMAGE.
  *
- * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_io.c#41 $
+ * $P4: //depot/projects/trustedbsd/openbsm/libbsm/bsm_io.c#42 $
  */
 
 #include <sys/types.h>
@@ -126,6 +127,12 @@
 } while (0)
 
 /*
+ * XML option.
+ */
+#define	AU_PLAIN	0
+#define	AU_XML		1
+
+/*
  * Prints the delimiter string.
  */
 static void
@@ -207,16 +214,334 @@
 }
 
 /*
+ * Prints the beggining of attribute.
+ */
+static void
+open_attr(FILE *fp, u_char *str)
+{
+
+	fprintf(fp,"%s=\"", str);
+}
+
+/*
+ * Prints the end of attribute.
+ */
+static void
+close_attr(FILE *fp)
+{
+
+	fprintf(fp,"\" ");
+}
+
+/*
+ * Prints the end of tag.
+ */
+static void
+close_tag(FILE *fp, u_char type)
+{
+
+	switch(type) {
+	case AUT_HEADER32:
+		fprintf(fp, ">");
+		break;
+
+	case AUT_HEADER32_EX:
+		fprintf(fp, ">");
+		break;
+
+	case AUT_HEADER64:
+		fprintf(fp, ">");
+		break;
+
+	case AUT_HEADER64_EX:
+		fprintf(fp, ">");
+		break;
+
+	case AUT_ARG32:
+		fprintf(fp, "/>");
+		break;
+
+	case AUT_ARG64:
+		fprintf(fp, "/>");
+		break;
+
+	case AUT_ATTR32:
+		fprintf(fp, "/>");
+		break;
+
+	case AUT_ATTR64:
+		fprintf(fp, "/>");
+		break;
+
+	case AUT_EXIT:
+		fprintf(fp, "/>");
+		break;
+
+	case AUT_EXEC_ARGS:
+		fprintf(fp, "</exec_args>");
+		break;
+
+	case AUT_EXEC_ENV:
+		fprintf(fp, "</exec_env>");
+		break;
+
+	case AUT_OTHER_FILE32:
+		fprintf(fp, "</file>");
+		break;
+
+	case AUT_NEWGROUPS:
+		fprintf(fp, "</group>");
+		break;
+
+	case AUT_IN_ADDR:
+		fprintf(fp, "</ip_address>");
+		break;
+
+	case AUT_IN_ADDR_EX:
+		fprintf(fp, "</ip_address>");
+		break;
+
+	case AUT_IP:
+		fprintf(fp, "/>");
+		break;
+
+	case AUT_IPC:
+		fprintf(fp, "/>");
+		break;
+
+	case AUT_IPC_PERM:
+		fprintf(fp, "/>");
+		break;
+
+	case AUT_IPORT:
+		fprintf(fp, "</ip_port>");
+		break;
+
+	case AUT_OPAQUE:
+		fprintf(fp, "</opaque>");
+		break;
+
+	case AUT_PATH:
+		fprintf(fp, "</path>");
+		break;
+
+	case AUT_PROCESS32:
+		fprintf(fp, "/>");
+		break;
+
+	case AUT_PROCESS32_EX:
+		fprintf(fp, "/>");
+		break;
+
+	case AUT_RETURN32:
+		fprintf(fp, "/>");
+		break;
+
+	case AUT_RETURN64:
+		fprintf(fp, "/>");
+		break;
+
+	case AUT_SEQ:
+		fprintf(fp, "/>");
+		break;
+
+	case AUT_SOCKET:
+		fprintf(fp, "/>");
+		break;
+
+	case AUT_SOCKINET32:
+		fprintf(fp, "/>");
+		break;
+
+	case AUT_SOCKUNIX:
+		fprintf(fp, "/>");
+		break;
+
+	case AUT_SUBJECT32:
+		fprintf(fp, "/>");
+		break;
+
+	case AUT_SUBJECT64:
+		fprintf(fp, "/>");
+		break;
+
+	case AUT_SUBJECT32_EX:
+		fprintf(fp, "/>");
+		break;
+
+	case AUT_TEXT:
+		fprintf(fp, "</text>");
+		break;
+
+	case AUT_SOCKET_EX:
+		fprintf(fp, "/>");
+		break;
+
+	case AUT_DATA:
+		fprintf(fp, "</arbitrary>");
+		break;
+	}
+}
+
+/*
  * Prints the token type in either the raw or the default form.
  */
 static void
-print_tok_type(FILE *fp, u_char type, const char *tokname, char raw)
+print_tok_type(FILE *fp, u_char type, const char *tokname, char raw, int xml)
 {
 
-	if (raw)
-		fprintf(fp, "%u", type);
-	else
-		fprintf(fp, "%s", tokname);
+	if (xml) {
+		switch(type) {
+		case AUT_HEADER32:
+			fprintf(fp, "<record ");
+			break;
+
+		case AUT_HEADER32_EX:
+			fprintf(fp, "<record ");
+			break;
+
+		case AUT_HEADER64:
+			fprintf(fp, "<record ");
+			break;
+
+		case AUT_HEADER64_EX:
+			fprintf(fp, "<record ");
+			break;
+
+		case AUT_TRAILER:
+			fprintf(fp, "</record>");
+			break;
+
+		case AUT_ARG32:
+			fprintf(fp, "<argument ");
+			break;
+
+		case AUT_ARG64:
+			fprintf(fp, "<argument ");
+			break;
+
+		case AUT_ATTR32:
+			fprintf(fp, "<attribute ");
+			break;
+
+		case AUT_ATTR64:
+			fprintf(fp, "<attribute ");
+			break;
+
+		case AUT_EXIT:
+			fprintf(fp, "<exit ");
+			break;
+
+		case AUT_EXEC_ARGS:
+			fprintf(fp, "<exec_args>");
+			break;
+
+		case AUT_EXEC_ENV:
+			fprintf(fp, "<exec_env>");
+			break;
+
+		case AUT_OTHER_FILE32:
+			fprintf(fp, "<file ");
+			break;
+
+		case AUT_NEWGROUPS:
+			fprintf(fp, "<group>");
+			break;
+
+		case AUT_IN_ADDR:
+			fprintf(fp, "<ip_address>");
+			break;
+
+		case AUT_IN_ADDR_EX:
+			fprintf(fp, "<ip_address>");
+			break;
+
+		case AUT_IP:
+			fprintf(fp, "<ip ");
+			break;
+
+		case AUT_IPC:
+			fprintf(fp, "<IPC");
+			break;
+
+		case AUT_IPC_PERM:
+			fprintf(fp, "<IPC_perm ");
+			break;
+
+		case AUT_IPORT:
+			fprintf(fp, "<ip_port>");
+			break;
+
+		case AUT_OPAQUE:
+			fprintf(fp, "<opaque>");
+			break;
+
+		case AUT_PATH:
+			fprintf(fp, "<path>");
+			break;
+
+		case AUT_PROCESS32:
+			fprintf(fp, "<process ");
+			break;
+
+		case AUT_PROCESS32_EX:
+			fprintf(fp, "<process ");
+			break;
+
+		case AUT_RETURN32:
+			fprintf(fp, "<return ");
+			break;
+
+		case AUT_RETURN64:
+			fprintf(fp, "<return ");
+			break;
+
+		case AUT_SEQ:
+			fprintf(fp, "<sequence ");
+			break;
+
+		case AUT_SOCKET:
+			fprintf(fp, "<socket ");
+			break;
+
+		case AUT_SOCKINET32:
+			fprintf(fp, "<old_socket");
+			break;
+
+		case AUT_SOCKUNIX:
+			fprintf(fp, "<old_socket");
+			break;
+
+		case AUT_SUBJECT32:
+			fprintf(fp, "<subject ");
+			break;
+
+		case AUT_SUBJECT64:
+			fprintf(fp, "<subject ");
+			break;
+
+		case AUT_SUBJECT32_EX:
+			fprintf(fp, "<subject ");
+			break;
+
+		case AUT_TEXT:
+			fprintf(fp, "<text>");
+			break;
+
+		case AUT_SOCKET_EX:
+			fprintf(fp, "<socket ");
+			break;
+
+		case AUT_DATA:
+			fprintf(fp, "<arbitrary ");
+			break;
+		}
+	} else {
+		if (raw)
+			fprintf(fp, "%u", type);
+		else
+			fprintf(fp, "%s", tokname);
+	}
 }
 
 /*
@@ -455,6 +780,27 @@
 }
 
 /*
+ * Print XML header.
+ */
+void
+au_print_xml_header(FILE *outfp)
+{
+	
+	fprintf(outfp, "<?xml version='1.0' ?>\n");
+	fprintf(outfp, "<audit>\n");
+}
+
+/*
+ * Print XML footer.
+ */
+void
+au_print_xml_footer(FILE *outfp)
+{
+	
+	fprintf(outfp, "</audit>\n");
+}
+
+/*
  * record byte count       4 bytes
  * version #               1 byte    [2]
  * event type              2 bytes
@@ -495,22 +841,42 @@
 }
 
 static void
-print_header32_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, char sfrm)
+print_header32_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, char sfrm,
+    int xml)
 {
 
-	print_tok_type(fp, tok->id, "header", raw);
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.hdr32.size, "%u");
-	print_delim(fp, del);
-	print_1_byte(fp, tok->tt.hdr32.version, "%u");
-	print_delim(fp, del);
-	print_event(fp, tok->tt.hdr32.e_type, raw, sfrm);
-	print_delim(fp, del);
-	print_evmod(fp, tok->tt.hdr32.e_mod, raw);
-	print_delim(fp, del);
-	print_sec32(fp, tok->tt.hdr32.s, raw);
-	print_delim(fp, del);
-	print_msec32(fp, tok->tt.hdr32.ms, raw);
+	print_tok_type(fp, tok->id, "header", raw, xml);
+	if (xml) {
+		open_attr(fp, "version");
+		print_1_byte(fp, tok->tt.hdr32.version, "%u");
+		close_attr(fp);
+		open_attr(fp, "event");
+		print_event(fp, tok->tt.hdr32.e_type, raw, sfrm);
+		close_attr(fp);
+		open_attr(fp, "modifier");
+		print_evmod(fp, tok->tt.hdr32.e_mod, raw);
+		close_attr(fp);
+		open_attr(fp, "time");
+		print_sec32(fp, tok->tt.hdr32.s, raw);
+		close_attr(fp);
+		open_attr(fp, "msec");
+		print_msec32(fp, tok->tt.hdr32.ms, 1);
+		close_attr(fp);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.hdr32.size, "%u");
+		print_delim(fp, del);
+		print_1_byte(fp, tok->tt.hdr32.version, "%u");
+		print_delim(fp, del);
+		print_event(fp, tok->tt.hdr32.e_type, raw, sfrm);
+		print_delim(fp, del);
+		print_evmod(fp, tok->tt.hdr32.e_mod, raw);
+		print_delim(fp, del);
+		print_sec32(fp, tok->tt.hdr32.s, raw);
+		print_delim(fp, del);
+		print_msec32(fp, tok->tt.hdr32.ms, raw);
+	}
 }
 
 /*
@@ -584,25 +950,50 @@
 
 static void
 print_header32_ex_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    char sfrm)
+    char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "header_ex", raw);
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.hdr32_ex.size, "%u");
-	print_delim(fp, del);
-	print_1_byte(fp, tok->tt.hdr32_ex.version, "%u");
-	print_delim(fp, del);
-	print_event(fp, tok->tt.hdr32_ex.e_type, raw, sfrm);
-	print_delim(fp, del);
-	print_evmod(fp, tok->tt.hdr32_ex.e_mod, raw);
-	print_delim(fp, del);
-	print_ip_ex_address(fp, tok->tt.hdr32_ex.ad_type,
-	    tok->tt.hdr32_ex.addr);
-	print_delim(fp, del);
-	print_sec32(fp, tok->tt.hdr32_ex.s, raw);
-	print_delim(fp, del);
-	print_msec32(fp, tok->tt.hdr32_ex.ms, raw);
+	print_tok_type(fp, tok->id, "header_ex", raw, xml);
+	if (xml) {
+		open_attr(fp, "version");
+		print_1_byte(fp, tok->tt.hdr32_ex.version, "%u");
+		close_attr(fp);
+		open_attr(fp, "event");
+		print_event(fp, tok->tt.hdr32_ex.e_type, raw, sfrm);
+		close_attr(fp);
+		open_attr(fp, "modifier");
+		print_evmod(fp, tok->tt.hdr32_ex.e_mod, raw);
+		close_attr(fp);
+		/*
+		 * No attribute for additional types.
+		 *
+		print_ip_ex_address(fp, tok->tt.hdr32_ex.ad_type,
+		    tok->tt.hdr32_ex.addr);
+		 */
+		open_attr(fp, "time");
+		print_sec32(fp, tok->tt.hdr32_ex.s, raw);
+		close_attr(fp);
+		open_attr(fp, "msec");
+		print_msec32(fp, tok->tt.hdr32_ex.ms, raw);
+		close_attr(fp);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.hdr32_ex.size, "%u");
+		print_delim(fp, del);
+		print_1_byte(fp, tok->tt.hdr32_ex.version, "%u");
+		print_delim(fp, del);
+		print_event(fp, tok->tt.hdr32_ex.e_type, raw, sfrm);
+		print_delim(fp, del);
+		print_evmod(fp, tok->tt.hdr32_ex.e_mod, raw);
+		print_delim(fp, del);
+		print_ip_ex_address(fp, tok->tt.hdr32_ex.ad_type,
+		    tok->tt.hdr32_ex.addr);
+		print_delim(fp, del);
+		print_sec32(fp, tok->tt.hdr32_ex.s, raw);
+		print_delim(fp, del);
+		print_msec32(fp, tok->tt.hdr32_ex.ms, raw);
+	}
 }
 
 /*
@@ -646,23 +1037,44 @@
 }
 
 static void
-print_header64_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, char sfrm)
+print_header64_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, char sfrm,
+    int xml)
 {
+	
+	print_tok_type(fp, tok->id, "header", raw, xml);
+	if (xml) {
+		open_attr(fp, "version");
+		print_1_byte(fp, tok->tt.hdr64.version, "%u");
+		close_attr(fp);
+		open_attr(fp, "event");
+		print_event(fp, tok->tt.hdr64.e_type, raw, sfrm);
+		close_attr(fp);
+		open_attr(fp, "modifier");
+		print_evmod(fp, tok->tt.hdr64.e_mod, raw);
+		close_attr(fp);
+		open_attr(fp, "time");
+		print_sec64(fp, tok->tt.hdr64.s, raw);
+		close_attr(fp);
+		open_attr(fp, "msec");
+		print_msec64(fp, tok->tt.hdr64.ms, raw);
+		close_attr(fp);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.hdr64.size, "%u");
+		print_delim(fp, del);
+		print_1_byte(fp, tok->tt.hdr64.version, "%u");
+		print_delim(fp, del);
+		print_event(fp, tok->tt.hdr64.e_type, raw, sfrm);
+		print_delim(fp, del);
+		print_evmod(fp, tok->tt.hdr64.e_mod, raw);
+		print_delim(fp, del);
+		print_sec64(fp, tok->tt.hdr64.s, raw);
+		print_delim(fp, del);
+		print_msec64(fp, tok->tt.hdr64.ms, raw);
+	}
+}
 
-	print_tok_type(fp, tok->id, "header", raw);
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.hdr64.size, "%u");
-	print_delim(fp, del);
-	print_1_byte(fp, tok->tt.hdr64.version, "%u");
-	print_delim(fp, del);
-	print_event(fp, tok->tt.hdr64.e_type, raw, sfrm);
-	print_delim(fp, del);
-	print_evmod(fp, tok->tt.hdr64.e_mod, raw);
-	print_delim(fp, del);
-	print_sec64(fp, tok->tt.hdr64.s, raw);
-	print_delim(fp, del);
-	print_msec64(fp, tok->tt.hdr64.ms, raw);
-}
 /*
  * record byte count       4 bytes
  * version #               1 byte     [2]
@@ -729,25 +1141,51 @@
 }
 
 static void
-print_header64_ex_tok(FILE *fp, tokenstr_t *tok, char *del, char raw, char sfrm)
+print_header64_ex_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
+    char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "header_ex", raw);
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.hdr64_ex.size, "%u");
-	print_delim(fp, del);
-	print_1_byte(fp, tok->tt.hdr64_ex.version, "%u");
-	print_delim(fp, del);
-	print_event(fp, tok->tt.hdr64_ex.e_type, raw, sfrm);
-	print_delim(fp, del);
-	print_evmod(fp, tok->tt.hdr64_ex.e_mod, raw);
-	print_delim(fp, del);
-	print_ip_ex_address(fp, tok->tt.hdr64_ex.ad_type,
-	    tok->tt.hdr64_ex.addr);
-	print_delim(fp, del);
-	print_sec64(fp, tok->tt.hdr64_ex.s, raw);
-	print_delim(fp, del);
-	print_msec64(fp, tok->tt.hdr64_ex.ms, raw);
+	print_tok_type(fp, tok->id, "header_ex", raw, xml);
+	if (xml) {
+		open_attr(fp, "version");
+		print_1_byte(fp, tok->tt.hdr64_ex.version, "%u");
+		close_attr(fp);
+		open_attr(fp, "event");
+		print_event(fp, tok->tt.hdr64_ex.e_type, raw, sfrm);
+		close_attr(fp);
+		open_attr(fp, "modifier");
+		print_evmod(fp, tok->tt.hdr64_ex.e_mod, raw);
+		close_attr(fp);
+		/*
+		 * No attribute for additional types.
+		 *
+		print_ip_ex_address(fp, tok->tt.hdr64_ex.ad_type,
+		    tok->tt.hdr64_ex.addr);
+		 */
+		open_attr(fp, "time");
+		print_sec64(fp, tok->tt.hdr64_ex.s, raw);
+		close_attr(fp);
+		open_attr(fp, "msec");
+		print_msec64(fp, tok->tt.hdr64_ex.ms, raw);
+		close_attr(fp);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.hdr64_ex.size, "%u");
+		print_delim(fp, del);
+		print_1_byte(fp, tok->tt.hdr64_ex.version, "%u");
+		print_delim(fp, del);
+		print_event(fp, tok->tt.hdr64_ex.e_type, raw, sfrm);
+		print_delim(fp, del);
+		print_evmod(fp, tok->tt.hdr64_ex.e_mod, raw);
+		print_delim(fp, del);
+		print_ip_ex_address(fp, tok->tt.hdr64_ex.ad_type,
+		    tok->tt.hdr64_ex.addr);
+		print_delim(fp, del);
+		print_sec64(fp, tok->tt.hdr64_ex.s, raw);
+		print_delim(fp, del);
+		print_msec64(fp, tok->tt.hdr64_ex.ms, raw);
+	}
 }
 
 /*
@@ -772,12 +1210,14 @@
 
 static void
 print_trailer_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "trailer", raw);
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.trail.count, "%u");
+	print_tok_type(fp, tok->id, "trailer", raw, xml);
+	if (!xml) {
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.trail.count, "%u");
+	}
 }
 
 /*
@@ -813,16 +1253,28 @@
 
 static void
 print_arg32_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "argument", raw);
-	print_delim(fp, del);
-	print_1_byte(fp, tok->tt.arg32.no, "%u");
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.arg32.val, "0x%x");
-	print_delim(fp, del);
-	print_string(fp, tok->tt.arg32.text, tok->tt.arg32.len);
+	print_tok_type(fp, tok->id, "argument", raw, xml);
+	if (xml) {
+		open_attr(fp, "arg-num");
+		print_1_byte(fp, tok->tt.arg32.no, "%u");
+		close_attr(fp);
+		open_attr(fp, "value");
+		print_4_bytes(fp, tok->tt.arg32.val, "0x%x");
+		close_attr(fp);
+		open_attr(fp, "desc");
+		print_string(fp, tok->tt.arg32.text, tok->tt.arg32.len);
+		close_attr(fp);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_1_byte(fp, tok->tt.arg32.no, "%u");
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.arg32.val, "0x%x");
+		print_delim(fp, del);
+	}
 }
 
 static int
@@ -852,16 +1304,29 @@
 
 static void
 print_arg64_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "argument", raw);
-	print_delim(fp, del);
-	print_1_byte(fp, tok->tt.arg64.no, "%u");
-	print_delim(fp, del);
-	print_8_bytes(fp, tok->tt.arg64.val, "0x%llx");
-	print_delim(fp, del);
-	print_string(fp, tok->tt.arg64.text, tok->tt.arg64.len);
+	print_tok_type(fp, tok->id, "argument", raw, xml);
+	if (xml) {
+		open_attr(fp, "arg-num");
+		print_1_byte(fp, tok->tt.arg64.no, "%u");
+		close_attr(fp);
+		open_attr(fp, "value");
+		print_8_bytes(fp, tok->tt.arg64.val, "0x%llx");
+		close_attr(fp);
+		open_attr(fp, "desc");
+		print_string(fp, tok->tt.arg64.text, tok->tt.arg64.len);
+		close_attr(fp);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_1_byte(fp, tok->tt.arg64.no, "%u");
+		print_delim(fp, del);
+		print_8_bytes(fp, tok->tt.arg64.val, "0x%llx");
+		print_delim(fp, del);
+		print_string(fp, tok->tt.arg64.text, tok->tt.arg64.len);
+	}
 }
 
 /*
@@ -924,15 +1389,16 @@
 
 static void
 print_arb_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 	char *str;
 	char *format;
 	size_t size;
 	int i;
 
-	print_tok_type(fp, tok->id, "arbitrary", raw);
-	print_delim(fp, del);
+	print_tok_type(fp, tok->id, "arbitrary", raw, xml);
+	if (!xml)
+		print_delim(fp, del);
 
 	switch(tok->tt.arb.howtopr) {
 	case AUP_BINARY:
@@ -964,56 +1430,125 @@
 		return;
 	}
 
-	print_string(fp, str, strlen(str));
-	print_delim(fp, del);
+	if (xml) {
+		open_attr(fp, "print");
+		fprintf(fp, "%s",str);
+		close_attr(fp);
+	} else {
+		print_string(fp, str, strlen(str));
+		print_delim(fp, del);
+	}
 	switch(tok->tt.arb.bu) {
 	case AUR_BYTE:
 	/* case AUR_CHAR: */
 		str = "byte";
 		size = AUR_BYTE_SIZE;
-		print_string(fp, str, strlen(str));
-		print_delim(fp, del);
-		print_1_byte(fp, tok->tt.arb.uc, "%u");
-		print_delim(fp, del);
-		for (i = 0; i<tok->tt.arb.uc; i++)
-			fprintf(fp, format, *(tok->tt.arb.data + (size * i)));
+		if (xml) {
+			open_attr(fp, "type");
+			fprintf(fp, "%u", size);
+			close_attr(fp);
+			open_attr(fp, "count");
+			print_1_byte(fp, tok->tt.arb.uc, "%u");
+			close_attr(fp);
+			fprintf(fp, ">");
+			for (i = 0; i<tok->tt.arb.uc; i++)
+				fprintf(fp, format, *(tok->tt.arb.data +
+				    (size * i)));
+			close_tag(fp, tok->id);
+		} else {
+			print_string(fp, str, strlen(str));
+			print_delim(fp, del);
+			print_1_byte(fp, tok->tt.arb.uc, "%u");
+			print_delim(fp, del);
+			for (i = 0; i<tok->tt.arb.uc; i++)
+				fprintf(fp, format, *(tok->tt.arb.data +
+				    (size * i)));
+		}
 		break;
 
 	case AUR_SHORT:
 		str = "short";
 		size = AUR_SHORT_SIZE;
-		print_string(fp, str, strlen(str));
-		print_delim(fp, del);
-		print_1_byte(fp, tok->tt.arb.uc, "%u");
-		print_delim(fp, del);
-		for (i = 0; i < tok->tt.arb.uc; i++)
-			fprintf(fp, format, *((u_int16_t *)(tok->tt.arb.data +
-			    (size * i))));
+		if (xml) {
+			open_attr(fp, "type");
+			fprintf(fp, "%u", size);
+			close_attr(fp);
+			open_attr(fp, "count");
+			print_1_byte(fp, tok->tt.arb.uc, "%u");
+			close_attr(fp);
+			fprintf(fp, ">");
+			for (i = 0; i < tok->tt.arb.uc; i++)
+				fprintf(fp, format,
+				    *((u_int16_t *)(tok->tt.arb.data +
+				    (size * i))));
+			close_tag(fp, tok->id);
+		} else {
+			print_string(fp, str, strlen(str));
+			print_delim(fp, del);
+			print_1_byte(fp, tok->tt.arb.uc, "%u");
+			print_delim(fp, del);
+			for (i = 0; i < tok->tt.arb.uc; i++)
+				fprintf(fp, format,
+				    *((u_int16_t *)(tok->tt.arb.data +
+				    (size * i))));
+		}
 		break;
 
 	case AUR_INT32:
 	/* case AUR_INT: */
 		str = "int";
 		size = AUR_INT32_SIZE;
-		print_string(fp, str, strlen(str));
-		print_delim(fp, del);
-		print_1_byte(fp, tok->tt.arb.uc, "%u");
-		print_delim(fp, del);
-		for (i = 0; i < tok->tt.arb.uc; i++)
-			fprintf(fp, format, *((u_int32_t *)(tok->tt.arb.data +
-			    (size * i))));
+		if (xml) {
+			open_attr(fp, "type");
+			fprintf(fp, "%u", size);
+			close_attr(fp);
+			open_attr(fp, "count");
+			print_1_byte(fp, tok->tt.arb.uc, "%u");
+			close_attr(fp);
+			fprintf(fp, ">");
+			for (i = 0; i < tok->tt.arb.uc; i++)
+				fprintf(fp, format,
+				    *((u_int32_t *)(tok->tt.arb.data +
+				    (size * i))));
+			close_tag(fp, tok->id);
+		} else {
+			print_string(fp, str, strlen(str));
+			print_delim(fp, del);
+			print_1_byte(fp, tok->tt.arb.uc, "%u");
+			print_delim(fp, del);
+			for (i = 0; i < tok->tt.arb.uc; i++)
+				fprintf(fp, format,
+				    *((u_int32_t *)(tok->tt.arb.data +
+				    (size * i))));
+		}
 		break;
 
 	case AUR_INT64:
 		str = "int64";
 		size = AUR_INT64_SIZE;
-		print_string(fp, str, strlen(str));
-		print_delim(fp, del);
-		print_1_byte(fp, tok->tt.arb.uc, "%u");
-		print_delim(fp, del);
-		for (i = 0; i < tok->tt.arb.uc; i++)
-			fprintf(fp, format, *((u_int64_t *)(tok->tt.arb.data +
-			    (size * i))));
+		if (xml) {
+			open_attr(fp, "type");
+			fprintf(fp, "%u", size);
+			close_attr(fp);
+			open_attr(fp, "count");
+			print_1_byte(fp, tok->tt.arb.uc, "%u");
+			close_attr(fp);
+			fprintf(fp, ">");
+			for (i = 0; i < tok->tt.arb.uc; i++)
+				fprintf(fp, format,
+				    *((u_int64_t *)(tok->tt.arb.data +
+				    (size * i))));
+			close_tag(fp, tok->id);
+		} else {
+			print_string(fp, str, strlen(str));
+			print_delim(fp, del);
+			print_1_byte(fp, tok->tt.arb.uc, "%u");
+			print_delim(fp, del);
+			for (i = 0; i < tok->tt.arb.uc; i++)
+				fprintf(fp, format,
+				    *((u_int64_t *)(tok->tt.arb.data +
+				    (size * i))));
+		}
 		break;
 
 	default:
@@ -1063,22 +1598,44 @@
 
 static void
 print_attr32_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "attribute", raw);
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.attr32.mode, "%o");
-	print_delim(fp, del);
-	print_user(fp, tok->tt.attr32.uid, raw);
-	print_delim(fp, del);
-	print_group(fp, tok->tt.attr32.gid, raw);
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.attr32.fsid, "%u");
-	print_delim(fp, del);
-	print_8_bytes(fp, tok->tt.attr32.nid, "%lld");
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.attr32.dev, "%u");
+	print_tok_type(fp, tok->id, "attribute", raw, xml);
+	if (xml) {
+		open_attr(fp, "mode");
+		print_4_bytes(fp, tok->tt.attr32.mode, "%o");
+		close_attr(fp);
+		open_attr(fp, "uid");
+		print_user(fp, tok->tt.attr32.uid, raw);
+		close_attr(fp);
+		open_attr(fp, "gid");
+		print_group(fp, tok->tt.attr32.gid, raw);
+		close_attr(fp);
+		open_attr(fp, "fsid");
+		print_4_bytes(fp, tok->tt.attr32.fsid, "%u");
+		close_attr(fp);
+		open_attr(fp, "nodeid");
+		print_8_bytes(fp, tok->tt.attr32.nid, "%lld");
+		close_attr(fp);
+		open_attr(fp, "device");
+		print_4_bytes(fp, tok->tt.attr32.dev, "%u");
+		close_attr(fp);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.attr32.mode, "%o");
+		print_delim(fp, del);
+		print_user(fp, tok->tt.attr32.uid, raw);
+		print_delim(fp, del);
+		print_group(fp, tok->tt.attr32.gid, raw);
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.attr32.fsid, "%u");
+		print_delim(fp, del);
+		print_8_bytes(fp, tok->tt.attr32.nid, "%lld");
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.attr32.dev, "%u");
+	}
 }
 
 /*
@@ -1123,22 +1680,44 @@
 
 static void
 print_attr64_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "attribute", raw);
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.attr64.mode, "%o");
-	print_delim(fp, del);
-	print_user(fp, tok->tt.attr64.uid, raw);
-	print_delim(fp, del);
-	print_group(fp, tok->tt.attr64.gid, raw);
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.attr64.fsid, "%u");
-	print_delim(fp, del);
-	print_8_bytes(fp, tok->tt.attr64.nid, "%lld");
-	print_delim(fp, del);
-	print_8_bytes(fp, tok->tt.attr64.dev, "%llu");
+	print_tok_type(fp, tok->id, "attribute", raw, xml);
+	if (xml) {
+		open_attr(fp, "mode");
+		print_4_bytes(fp, tok->tt.attr64.mode, "%o");
+		close_attr(fp);
+		open_attr(fp, "uid");
+		print_user(fp, tok->tt.attr64.uid, raw);
+		close_attr(fp);
+		open_attr(fp, "gid");
+		print_group(fp, tok->tt.attr64.gid, raw);
+		close_attr(fp);
+		open_attr(fp, "fsid");
+		print_4_bytes(fp, tok->tt.attr64.fsid, "%u");
+		close_attr(fp);
+		open_attr(fp, "nodeid");
+		print_8_bytes(fp, tok->tt.attr64.nid, "%lld");
+		close_attr(fp);
+		open_attr(fp, "device");
+		print_8_bytes(fp, tok->tt.attr64.dev, "%llu");
+		close_attr(fp);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.attr64.mode, "%o");
+		print_delim(fp, del);
+		print_user(fp, tok->tt.attr64.uid, raw);
+		print_delim(fp, del);
+		print_group(fp, tok->tt.attr64.gid, raw);
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.attr64.fsid, "%u");
+		print_delim(fp, del);
+		print_8_bytes(fp, tok->tt.attr64.nid, "%lld");
+		print_delim(fp, del);
+		print_8_bytes(fp, tok->tt.attr64.dev, "%llu");
+	}
 }
 
 /*
@@ -1163,14 +1742,24 @@
 
 static void
 print_exit_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "exit", raw);
-	print_delim(fp, del);
-	print_errval(fp, tok->tt.exit.status);
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.exit.ret, "%u");
+	print_tok_type(fp, tok->id, "exit", raw, xml);
+	if (xml) {
+		open_attr(fp, "errval");
+		print_errval(fp, tok->tt.exit.status);
+		close_attr(fp);
+		open_attr(fp, "retval");
+		print_4_bytes(fp, tok->tt.exit.ret, "%u");
+		close_attr(fp);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_errval(fp, tok->tt.exit.status);
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.exit.ret, "%u");
+	}
 }
 
 /*
@@ -1211,16 +1800,25 @@
 
 static void
 print_execarg_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 	int i;
 
-	print_tok_type(fp, tok->id, "exec arg", raw);
+	print_tok_type(fp, tok->id, "exec arg", raw, xml);
 	for (i = 0; i < tok->tt.execarg.count; i++) {
-		print_delim(fp, del);
-		print_string(fp, tok->tt.execarg.text[i],
-		    strlen(tok->tt.execarg.text[i]));
+		if (xml) {
+			fprintf(fp, "<arg>");
+			print_string(fp, tok->tt.execarg.text[i],
+			    strlen(tok->tt.execarg.text[i]));
+			fprintf(fp, "</arg>");
+		} else {
+			print_delim(fp, del);
+			print_string(fp, tok->tt.execarg.text[i],
+			    strlen(tok->tt.execarg.text[i]));
+		}
 	}
+	if (xml)
+		close_tag(fp, tok->id);
 }
 
 /*
@@ -1261,16 +1859,25 @@
 
 static void
 print_execenv_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 	int i;
 
-	print_tok_type(fp, tok->id, "exec env", raw);
+	print_tok_type(fp, tok->id, "exec env", raw, xml);
 	for (i = 0; i< tok->tt.execenv.count; i++) {
-		print_delim(fp, del);
-		print_string(fp, tok->tt.execenv.text[i],
-		    strlen(tok->tt.execenv.text[i]));
+		if (xml) {
+			fprintf(fp, "<env>");
+			print_string(fp, tok->tt.execenv.text[i],
+			    strlen(tok->tt.execenv.text[i]));
+			fprintf(fp, "</env>");
+		} else {
+			print_delim(fp, del);
+			print_string(fp, tok->tt.execenv.text[i],
+			    strlen(tok->tt.execenv.text[i]));
+		}
 	}
+	if (xml)
+		close_tag(fp, tok->id);
 }
 
 /*
@@ -1305,16 +1912,28 @@
 
 static void
 print_file_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "file", raw);
-	print_delim(fp, del);
-	print_sec32(fp, tok->tt.file.s, raw);
-	print_delim(fp, del);
-	print_msec32(fp, tok->tt.file.ms, raw);
-	print_delim(fp, del);
-	print_string(fp, tok->tt.file.name, tok->tt.file.len);
+	print_tok_type(fp, tok->id, "file", raw, xml);
+	if (xml) {
+		open_attr(fp, "time");
+		print_sec32(fp, tok->tt.file.s, raw);
+		close_attr(fp);
+		open_attr(fp, "msec");
+		print_msec32(fp, tok->tt.file.ms, raw);
+		close_attr(fp);
+		fprintf(fp, ">");
+		print_string(fp, tok->tt.file.name, tok->tt.file.len);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_sec32(fp, tok->tt.file.s, raw);
+		print_delim(fp, del);
+		print_msec32(fp, tok->tt.file.ms, raw);
+		print_delim(fp, del);
+		print_string(fp, tok->tt.file.name, tok->tt.file.len);
+	}
 }
 
 /*
@@ -1343,14 +1962,21 @@
 
 static void
 print_newgroups_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 	int i;
 
-	print_tok_type(fp, tok->id, "group", raw);
+	print_tok_type(fp, tok->id, "group", raw, xml);
 	for (i = 0; i < tok->tt.grps.no; i++) {
-		print_delim(fp, del);
-		print_group(fp, tok->tt.grps.list[i], raw);
+		if (xml) {
+			fprintf(fp, "<gid>");
+			print_group(fp, tok->tt.grps.list[i], raw);
+			fprintf(fp, "</gid>");
+			close_tag(fp, tok->id);
+		} else {
+			print_delim(fp, del);
+			print_group(fp, tok->tt.grps.list[i], raw);
+		}
 	}
 }
 
@@ -1373,12 +1999,17 @@
 
 static void
 print_inaddr_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "ip addr", raw);
-	print_delim(fp, del);
-	print_ip_address(fp, tok->tt.inaddr.addr);
+	print_tok_type(fp, tok->id, "ip addr", raw, xml);
+	if (xml) {
+		print_ip_address(fp, tok->tt.inaddr.addr);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_ip_address(fp, tok->tt.inaddr.addr);
+	}
 }
 
 /*
@@ -1412,13 +2043,19 @@
 
 static void
 print_inaddr_ex_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "ip addr ex", raw);
-	print_delim(fp, del);
-	print_ip_ex_address(fp, tok->tt.inaddr_ex.type,
-	    tok->tt.inaddr_ex.addr);
+	print_tok_type(fp, tok->id, "ip addr ex", raw, xml);
+	if (xml) {
+		print_ip_ex_address(fp, tok->tt.inaddr_ex.type,
+		    tok->tt.inaddr_ex.addr);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_ip_ex_address(fp, tok->tt.inaddr_ex.type,
+		    tok->tt.inaddr_ex.addr);
+	}
 }
 
 /*
@@ -1480,30 +2117,66 @@
 
 static void
 print_ip_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "ip", raw);
-	print_delim(fp, del);
-	print_mem(fp, (u_char *)(&tok->tt.ip.version), sizeof(u_char));
-	print_delim(fp, del);
-	print_mem(fp, (u_char *)(&tok->tt.ip.tos), sizeof(u_char));
-	print_delim(fp, del);
-	print_2_bytes(fp, ntohs(tok->tt.ip.len), "%u");
-	print_delim(fp, del);
-	print_2_bytes(fp, ntohs(tok->tt.ip.id), "%u");
-	print_delim(fp, del);
-	print_2_bytes(fp, ntohs(tok->tt.ip.offset), "%u");
-	print_delim(fp, del);
-	print_mem(fp, (u_char *)(&tok->tt.ip.ttl), sizeof(u_char));
-	print_delim(fp, del);
-	print_mem(fp, (u_char *)(&tok->tt.ip.prot), sizeof(u_char));
-	print_delim(fp, del);
-	print_2_bytes(fp, ntohs(tok->tt.ip.chksm), "%u");
-	print_delim(fp, del);
-	print_ip_address(fp, tok->tt.ip.src);
-	print_delim(fp, del);
-	print_ip_address(fp, tok->tt.ip.dest);
+	print_tok_type(fp, tok->id, "ip", raw, xml);
+	if (xml) {
+		open_attr(fp, "version");
+		print_mem(fp, (u_char *)(&tok->tt.ip.version),
+		    sizeof(u_char));
+		close_attr(fp);
+		open_attr(fp, "service_type");
+		print_mem(fp, (u_char *)(&tok->tt.ip.tos), sizeof(u_char));
+		close_attr(fp);
+		open_attr(fp, "len");
+		print_2_bytes(fp, ntohs(tok->tt.ip.len), "%u");
+		close_attr(fp);
+		open_attr(fp, "id");
+		print_2_bytes(fp, ntohs(tok->tt.ip.id), "%u");
+		close_attr(fp);
+		open_attr(fp, "offset");
+		print_2_bytes(fp, ntohs(tok->tt.ip.offset), "%u");
+		close_attr(fp);
+		open_attr(fp, "time_to_live");
+		print_mem(fp, (u_char *)(&tok->tt.ip.ttl), sizeof(u_char));
+		close_attr(fp);
+		open_attr(fp, "protocol");
+		print_mem(fp, (u_char *)(&tok->tt.ip.prot), sizeof(u_char));
+		close_attr(fp);
+		open_attr(fp, "cksum");
+		print_2_bytes(fp, ntohs(tok->tt.ip.chksm), "%u");
+		close_attr(fp);
+		open_attr(fp, "src_addr");
+		print_ip_address(fp, tok->tt.ip.src);
+		close_attr(fp);
+		open_attr(fp, "dest_addr");
+		print_ip_address(fp, tok->tt.ip.dest);
+		close_attr(fp);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_mem(fp, (u_char *)(&tok->tt.ip.version),
+		    sizeof(u_char));
+		print_delim(fp, del);
+		print_mem(fp, (u_char *)(&tok->tt.ip.tos), sizeof(u_char));
+		print_delim(fp, del);
+		print_2_bytes(fp, ntohs(tok->tt.ip.len), "%u");
+		print_delim(fp, del);
+		print_2_bytes(fp, ntohs(tok->tt.ip.id), "%u");
+		print_delim(fp, del);
+		print_2_bytes(fp, ntohs(tok->tt.ip.offset), "%u");
+		print_delim(fp, del);
+		print_mem(fp, (u_char *)(&tok->tt.ip.ttl), sizeof(u_char));
+		print_delim(fp, del);
+		print_mem(fp, (u_char *)(&tok->tt.ip.prot), sizeof(u_char));
+		print_delim(fp, del);
+		print_2_bytes(fp, ntohs(tok->tt.ip.chksm), "%u");
+		print_delim(fp, del);
+		print_ip_address(fp, tok->tt.ip.src);
+		print_delim(fp, del);
+		print_ip_address(fp, tok->tt.ip.dest);
+	}
 }
 
 /*
@@ -1528,14 +2201,24 @@
 
 static void
 print_ipc_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "IPC", raw);
-	print_delim(fp, del);
-	print_ipctype(fp, tok->tt.ipc.type, raw);
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.ipc.id, "%u");
+	print_tok_type(fp, tok->id, "IPC", raw, xml);
+	if (xml) {
+		open_attr(fp, "ipc-type");
+		print_ipctype(fp, tok->tt.ipc.type, raw);
+		close_attr(fp);
+		open_attr(fp, "ipc-id");
+		print_4_bytes(fp, tok->tt.ipc.id, "%u");
+		close_attr(fp);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_ipctype(fp, tok->tt.ipc.type, raw);
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.ipc.id, "%u");
+	}
 }
 
 /*
@@ -1585,24 +2268,49 @@
 
 static void
 print_ipcperm_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "IPC perm", raw);
-	print_delim(fp, del);
-	print_user(fp, tok->tt.ipcperm.uid, raw);
-	print_delim(fp, del);
-	print_group(fp, tok->tt.ipcperm.gid, raw);
-	print_delim(fp, del);
-	print_user(fp, tok->tt.ipcperm.puid, raw);
-	print_delim(fp, del);
-	print_group(fp, tok->tt.ipcperm.pgid, raw);
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.ipcperm.mode, "%o");
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.ipcperm.seq, "%u");
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.ipcperm.key, "%u");
+	print_tok_type(fp, tok->id, "IPC perm", raw, xml);
+	if (xml) {
+		open_attr(fp, "uid");
+		print_user(fp, tok->tt.ipcperm.uid, raw);
+		close_attr(fp);
+		open_attr(fp, "gid");
+		print_group(fp, tok->tt.ipcperm.gid, raw);
+		close_attr(fp);
+		open_attr(fp, "creator-uid");
+		print_user(fp, tok->tt.ipcperm.puid, raw);
+		close_attr(fp);
+		open_attr(fp, "creator-gid");
+		print_group(fp, tok->tt.ipcperm.pgid, raw);
+		close_attr(fp);
+		open_attr(fp, "mode");
+		print_4_bytes(fp, tok->tt.ipcperm.mode, "%o");
+		close_attr(fp);
+		open_attr(fp, "seq");
+		print_4_bytes(fp, tok->tt.ipcperm.seq, "%u");
+		close_attr(fp);
+		open_attr(fp, "key");
+		print_4_bytes(fp, tok->tt.ipcperm.key, "%u");
+		close_attr(fp);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_user(fp, tok->tt.ipcperm.uid, raw);
+		print_delim(fp, del);
+		print_group(fp, tok->tt.ipcperm.gid, raw);
+		print_delim(fp, del);
+		print_user(fp, tok->tt.ipcperm.puid, raw);
+		print_delim(fp, del);
+		print_group(fp, tok->tt.ipcperm.pgid, raw);
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.ipcperm.mode, "%o");
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.ipcperm.seq, "%u");
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.ipcperm.key, "%u");
+	}
 }
 
 /*
@@ -1623,12 +2331,17 @@
 
 static void
 print_iport_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "ip port", raw);
-	print_delim(fp, del);
-	print_2_bytes(fp, ntohs(tok->tt.iport.port), "%#x");
+	print_tok_type(fp, tok->id, "ip port", raw, xml);
+	if (xml) {
+		print_2_bytes(fp, ntohs(tok->tt.iport.port), "%#x");
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_2_bytes(fp, ntohs(tok->tt.iport.port), "%#x");
+	}
 }
 
 /*
@@ -1654,14 +2367,19 @@
 
 static void
 print_opaque_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "opaque", raw);
-	print_delim(fp, del);
-	print_2_bytes(fp, tok->tt.opaque.size, "%u");
-	print_delim(fp, del);
-	print_mem(fp, tok->tt.opaque.data, tok->tt.opaque.size);
+	print_tok_type(fp, tok->id, "opaque", raw, xml);
+	if (xml) {
+		print_mem(fp, tok->tt.opaque.data, tok->tt.opaque.size);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_2_bytes(fp, tok->tt.opaque.size, "%u");
+		print_delim(fp, del);
+		print_mem(fp, tok->tt.opaque.data, tok->tt.opaque.size);
+	}
 }
 
 /*
@@ -1686,12 +2404,17 @@
 
 static void
 print_path_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "path", raw);
-	print_delim(fp, del);
-	print_string(fp, tok->tt.path.path, tok->tt.path.len);
+	print_tok_type(fp, tok->id, "path", raw, xml);
+	if (xml) {
+		print_string(fp, tok->tt.path.path, tok->tt.path.len);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_string(fp, tok->tt.path.path, tok->tt.path.len);
+	}
 }
 
 /*
@@ -1754,28 +2477,57 @@
 
 static void
 print_process32_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "process", raw);
-	print_delim(fp, del);
-	print_user(fp, tok->tt.proc32.auid, raw);
-	print_delim(fp, del);
-	print_user(fp, tok->tt.proc32.euid, raw);
-	print_delim(fp, del);
-	print_group(fp, tok->tt.proc32.egid, raw);
-	print_delim(fp, del);
-	print_user(fp, tok->tt.proc32.ruid, raw);
-	print_delim(fp, del);
-	print_group(fp, tok->tt.proc32.rgid, raw);
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.proc32.pid, "%u");
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.proc32.sid, "%u");
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.proc32.tid.port, "%u");
-	print_delim(fp, del);
-	print_ip_address(fp, tok->tt.proc32.tid.addr);
+	print_tok_type(fp, tok->id, "process", raw, xml);
+	if (xml) {
+		open_attr(fp, "audit-uid");
+		print_user(fp, tok->tt.proc32.auid, raw);
+		close_attr(fp);
+		open_attr(fp, "uid");
+		print_user(fp, tok->tt.proc32.euid, raw);
+		close_attr(fp);
+		open_attr(fp, "gid");
+		print_group(fp, tok->tt.proc32.egid, raw);
+		close_attr(fp);
+		open_attr(fp, "ruid");
+		print_user(fp, tok->tt.proc32.ruid, raw);
+		close_attr(fp);
+		open_attr(fp, "rgid");
+		print_group(fp, tok->tt.proc32.rgid, raw);
+		close_attr(fp);
+		open_attr(fp, "pid");
+		print_4_bytes(fp, tok->tt.proc32.pid, "%u");
+		close_attr(fp);
+		open_attr(fp, "sid");
+		print_4_bytes(fp, tok->tt.proc32.sid, "%u");
+		close_attr(fp);
+		open_attr(fp, "tid");
+		print_4_bytes(fp, tok->tt.proc32.tid.port, "%u");
+		print_ip_address(fp, tok->tt.proc32.tid.addr);
+		close_attr(fp);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_user(fp, tok->tt.proc32.auid, raw);
+		print_delim(fp, del);
+		print_user(fp, tok->tt.proc32.euid, raw);
+		print_delim(fp, del);
+		print_group(fp, tok->tt.proc32.egid, raw);
+		print_delim(fp, del);
+		print_user(fp, tok->tt.proc32.ruid, raw);
+		print_delim(fp, del);
+		print_group(fp, tok->tt.proc32.rgid, raw);
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.proc32.pid, "%u");
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.proc32.sid, "%u");
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.proc32.tid.port, "%u");
+		print_delim(fp, del);
+		print_ip_address(fp, tok->tt.proc32.tid.addr);
+	}
 }
 
 static int
@@ -1839,29 +2591,59 @@
 
 static void
 print_process32ex_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "process_ex", raw);
-	print_delim(fp, del);
-	print_user(fp, tok->tt.proc32_ex.auid, raw);
-	print_delim(fp, del);
-	print_user(fp, tok->tt.proc32_ex.euid, raw);
-	print_delim(fp, del);
-	print_group(fp, tok->tt.proc32_ex.egid, raw);
-	print_delim(fp, del);
-	print_user(fp, tok->tt.proc32_ex.ruid, raw);
-	print_delim(fp, del);
-	print_group(fp, tok->tt.proc32_ex.rgid, raw);
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.proc32_ex.pid, "%u");
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.proc32_ex.sid, "%u");
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.proc32_ex.tid.port, "%u");
-	print_delim(fp, del);
-	print_ip_ex_address(fp, tok->tt.proc32_ex.tid.type,
-	    tok->tt.proc32_ex.tid.addr);
+	print_tok_type(fp, tok->id, "process_ex", raw, xml);
+	if (xml) {
+		open_attr(fp, "audit-uid");
+		print_user(fp, tok->tt.proc32_ex.auid, raw);
+		close_attr(fp);
+		open_attr(fp, "uid");
+		print_user(fp, tok->tt.proc32_ex.euid, raw);
+		close_attr(fp);
+		open_attr(fp, "gid");
+		print_group(fp, tok->tt.proc32_ex.egid, raw);
+		close_attr(fp);
+		open_attr(fp, "ruid");
+		print_user(fp, tok->tt.proc32_ex.ruid, raw);
+		close_attr(fp);
+		open_attr(fp, "rgid");
+		print_group(fp, tok->tt.proc32_ex.rgid, raw);
+		close_attr(fp);
+		open_attr(fp, "pid");
+		print_4_bytes(fp, tok->tt.proc32_ex.pid, "%u");
+		close_attr(fp);
+		open_attr(fp, "sid");
+		print_4_bytes(fp, tok->tt.proc32_ex.sid, "%u");
+		close_attr(fp);
+		open_attr(fp, "tid");
+		print_4_bytes(fp, tok->tt.proc32_ex.tid.port, "%u");
+		print_ip_ex_address(fp, tok->tt.proc32_ex.tid.type,
+		    tok->tt.proc32_ex.tid.addr);
+		close_attr(fp);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_user(fp, tok->tt.proc32_ex.auid, raw);
+		print_delim(fp, del);
+		print_user(fp, tok->tt.proc32_ex.euid, raw);
+		print_delim(fp, del);
+		print_group(fp, tok->tt.proc32_ex.egid, raw);
+		print_delim(fp, del);
+		print_user(fp, tok->tt.proc32_ex.ruid, raw);
+		print_delim(fp, del);
+		print_group(fp, tok->tt.proc32_ex.rgid, raw);
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.proc32_ex.pid, "%u");
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.proc32_ex.sid, "%u");
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.proc32_ex.tid.port, "%u");
+		print_delim(fp, del);
+		print_ip_ex_address(fp, tok->tt.proc32_ex.tid.type,
+		    tok->tt.proc32_ex.tid.addr);
+	}
 }
 
 /*
@@ -1886,14 +2668,24 @@
 
 static void
 print_return32_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "return", raw);
-	print_delim(fp, del);
-	print_retval(fp, tok->tt.ret32.status, raw);
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.ret32.ret, "%u");
+	print_tok_type(fp, tok->id, "return", raw, xml);
+	if (xml) {
+		open_attr(fp ,"errval");
+		print_retval(fp, tok->tt.ret32.status, raw);
+		close_attr(fp);
+		open_attr(fp, "retval");
+		print_4_bytes(fp, tok->tt.ret32.ret, "%u");
+		close_attr(fp);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_retval(fp, tok->tt.ret32.status, raw);
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.ret32.ret, "%u");
+	}
 }
 
 static int
@@ -1914,14 +2706,24 @@
 
 static void
 print_return64_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "return", raw);
-	print_delim(fp, del);
-	print_retval(fp, tok->tt.ret64.err, raw);
-	print_delim(fp, del);
-	print_8_bytes(fp, tok->tt.ret64.val, "%lld");
+	print_tok_type(fp, tok->id, "return", raw, xml);
+	if (xml) {
+		open_attr(fp, "errval");
+		print_retval(fp, tok->tt.ret64.err, raw);
+		close_attr(fp);
+		open_attr(fp, "retval");
+		print_8_bytes(fp, tok->tt.ret64.val, "%lld");
+		close_attr(fp);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_retval(fp, tok->tt.ret64.err, raw);
+		print_delim(fp, del);
+		print_8_bytes(fp, tok->tt.ret64.val, "%lld");
+	}
 }
 
 /*
@@ -1941,12 +2743,19 @@
 
 static void
 print_seq_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "sequence", raw);
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.seq.seqno, "%u");
+	print_tok_type(fp, tok->id, "sequence", raw, xml);
+	if (xml) {
+		open_attr(fp, "seq-num");
+		print_4_bytes(fp, tok->tt.seq.seqno, "%u");
+		close_attr(fp);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.seq.seqno, "%u");
+	}
 }
 
 /*
@@ -1979,16 +2788,29 @@
 
 static void
 print_sock_inet32_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "socket-inet", raw);
-	print_delim(fp, del);
-	print_2_bytes(fp, tok->tt.sockinet32.family, "%u");
-	print_delim(fp, del);
-	print_2_bytes(fp, ntohs(tok->tt.sockinet32.port), "%u");
-	print_delim(fp, del);
-	print_ip_address(fp, tok->tt.sockinet32.addr);
+	print_tok_type(fp, tok->id, "socket-inet", raw, xml);
+	if (xml) {
+		open_attr(fp, "type");
+		print_2_bytes(fp, tok->tt.sockinet32.family, "%u");
+		close_attr(fp);
+		open_attr(fp, "port");
+		print_2_bytes(fp, ntohs(tok->tt.sockinet32.port), "%u");
+		close_attr(fp);
+		open_attr(fp, "addr");
+		print_ip_address(fp, tok->tt.sockinet32.addr);
+		close_attr(fp);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_2_bytes(fp, tok->tt.sockinet32.family, "%u");
+		print_delim(fp, del);
+		print_2_bytes(fp, ntohs(tok->tt.sockinet32.port), "%u");
+		print_delim(fp, del);
+		print_ip_address(fp, tok->tt.sockinet32.addr);
+	}
 }
 
 /*
@@ -2014,15 +2836,28 @@
 
 static void
 print_sock_unix_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "socket-unix", raw);
-	print_delim(fp, del);
-	print_2_bytes(fp, tok->tt.sockunix.family, "%u");
-	print_delim(fp, del);
-	print_string(fp, tok->tt.sockunix.path,
-	    strlen(tok->tt.sockunix.path));
+	print_tok_type(fp, tok->id, "socket-unix", raw, xml);
+	if (xml) {
+		open_attr(fp, "type");
+		print_2_bytes(fp, tok->tt.sockunix.family, "%u");
+		close_attr(fp);
+		open_attr(fp, "port");
+		close_attr(fp);
+		open_attr(fp, "addr");
+		print_string(fp, tok->tt.sockunix.path,
+			strlen(tok->tt.sockunix.path));
+		close_attr(fp);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_2_bytes(fp, tok->tt.sockunix.family, "%u");
+		print_delim(fp, del);
+		print_string(fp, tok->tt.sockunix.path,
+			strlen(tok->tt.sockunix.path));
+	}
 }
 
 /*
@@ -2066,20 +2901,39 @@
 
 static void
 print_socket_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "socket", raw);
-	print_delim(fp, del);
-	print_2_bytes(fp, tok->tt.socket.type, "%u");
-	print_delim(fp, del);
-	print_2_bytes(fp, ntohs(tok->tt.socket.l_port), "%u");
-	print_delim(fp, del);
-	print_ip_address(fp, tok->tt.socket.l_addr);
-	print_delim(fp, del);
-	print_2_bytes(fp, ntohs(tok->tt.socket.r_port), "%u");
-	print_delim(fp, del);
-	print_ip_address(fp, tok->tt.socket.r_addr);
+	print_tok_type(fp, tok->id, "socket", raw, xml);
+	if (xml) {
+		open_attr(fp, "sock_type");
+		print_2_bytes(fp, tok->tt.socket.type, "%u");
+		close_attr(fp);
+		open_attr(fp, "lport");
+		print_2_bytes(fp, ntohs(tok->tt.socket.l_port), "%u");
+		close_attr(fp);
+		open_attr(fp, "laddr");
+		print_ip_address(fp, tok->tt.socket.l_addr);
+		close_attr(fp);
+		open_attr(fp, "fport");
+		print_2_bytes(fp, ntohs(tok->tt.socket.r_port), "%u");
+		close_attr(fp);
+		open_attr(fp, "faddr");
+		print_ip_address(fp, tok->tt.socket.r_addr);
+		close_attr(fp);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_2_bytes(fp, tok->tt.socket.type, "%u");
+		print_delim(fp, del);
+		print_2_bytes(fp, ntohs(tok->tt.socket.l_port), "%u");
+		print_delim(fp, del);
+		print_ip_address(fp, tok->tt.socket.l_addr);
+		print_delim(fp, del);
+		print_2_bytes(fp, ntohs(tok->tt.socket.r_port), "%u");
+		print_delim(fp, del);
+		print_ip_address(fp, tok->tt.socket.r_addr);
+	}
 }
 
 /*
@@ -2141,28 +2995,57 @@
 
 static void
 print_subject32_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "subject", raw);
-	print_delim(fp, del);
-	print_user(fp, tok->tt.subj32.auid, raw);
-	print_delim(fp, del);
-	print_user(fp, tok->tt.subj32.euid, raw);
-	print_delim(fp, del);
-	print_group(fp, tok->tt.subj32.egid, raw);
-	print_delim(fp, del);
-	print_user(fp, tok->tt.subj32.ruid, raw);
-	print_delim(fp, del);
-	print_group(fp, tok->tt.subj32.rgid, raw);
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.subj32.pid, "%u");
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.subj32.sid, "%u");
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.subj32.tid.port, "%u");
-	print_delim(fp, del);
-	print_ip_address(fp, tok->tt.subj32.tid.addr);
+	print_tok_type(fp, tok->id, "subject", raw, xml);
+	if (xml) {
+		open_attr(fp, "audit-uid");
+		print_user(fp, tok->tt.subj32.auid, raw);
+		close_attr(fp);
+		open_attr(fp, "uid");
+		print_user(fp, tok->tt.subj32.euid, raw);
+		close_attr(fp);
+		open_attr(fp, "gid");
+		print_group(fp, tok->tt.subj32.egid, raw);
+		close_attr(fp);
+		open_attr(fp, "ruid");
+		print_user(fp, tok->tt.subj32.ruid, raw);
+		close_attr(fp);
+		open_attr(fp, "rgid");
+		print_group(fp, tok->tt.subj32.rgid, raw);
+		close_attr(fp);
+		open_attr(fp,"pid");
+		print_4_bytes(fp, tok->tt.subj32.pid, "%u");
+		close_attr(fp);
+		open_attr(fp,"sid");
+		print_4_bytes(fp, tok->tt.subj32.sid, "%u");
+		close_attr(fp);
+		open_attr(fp,"tid");
+		print_4_bytes(fp, tok->tt.subj32.tid.port, "%u ");
+		print_ip_address(fp, tok->tt.subj32.tid.addr);
+		close_attr(fp);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_user(fp, tok->tt.subj32.auid, raw);
+		print_delim(fp, del);
+		print_user(fp, tok->tt.subj32.euid, raw);
+		print_delim(fp, del);
+		print_group(fp, tok->tt.subj32.egid, raw);
+		print_delim(fp, del);
+		print_user(fp, tok->tt.subj32.ruid, raw);
+		print_delim(fp, del);
+		print_group(fp, tok->tt.subj32.rgid, raw);
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.subj32.pid, "%u");
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.subj32.sid, "%u");
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.subj32.tid.port, "%u");
+		print_delim(fp, del);
+		print_ip_address(fp, tok->tt.subj32.tid.addr);
+	}
 }
 
 /*
@@ -2224,28 +3107,57 @@
 
 static void
 print_subject64_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "subject", raw);
-	print_delim(fp, del);
-	print_user(fp, tok->tt.subj64.auid, raw);
-	print_delim(fp, del);
-	print_user(fp, tok->tt.subj64.euid, raw);
-	print_delim(fp, del);
-	print_group(fp, tok->tt.subj64.egid, raw);
-	print_delim(fp, del);
-	print_user(fp, tok->tt.subj64.ruid, raw);
-	print_delim(fp, del);
-	print_group(fp, tok->tt.subj64.rgid, raw);
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.subj64.pid, "%u");
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.subj64.sid, "%u");
-	print_delim(fp, del);
-	print_8_bytes(fp, tok->tt.subj64.tid.port, "%llu");
-	print_delim(fp, del);
-	print_ip_address(fp, tok->tt.subj64.tid.addr);
+	print_tok_type(fp, tok->id, "subject", raw, xml);
+	if (xml) {
+		open_attr(fp, "audit-uid");
+		print_user(fp, tok->tt.subj64.auid, raw);
+		close_attr(fp);
+		open_attr(fp, "uid");
+		print_user(fp, tok->tt.subj64.euid, raw);
+		close_attr(fp);
+		open_attr(fp, "gid");
+		print_group(fp, tok->tt.subj64.egid, raw);
+		close_attr(fp);
+		open_attr(fp, "ruid");
+		print_user(fp, tok->tt.subj64.ruid, raw);
+		close_attr(fp);
+		open_attr(fp, "rgid");
+		print_group(fp, tok->tt.subj64.rgid, raw);
+		close_attr(fp);
+		open_attr(fp, "pid");
+		print_4_bytes(fp, tok->tt.subj64.pid, "%u");
+		close_attr(fp);
+		open_attr(fp, "sid");
+		print_4_bytes(fp, tok->tt.subj64.sid, "%u");
+		close_attr(fp);
+		open_attr(fp, "tid");
+		print_8_bytes(fp, tok->tt.subj64.tid.port, "%llu");
+		print_ip_address(fp, tok->tt.subj64.tid.addr);
+		close_attr(fp);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_user(fp, tok->tt.subj64.auid, raw);
+		print_delim(fp, del);
+		print_user(fp, tok->tt.subj64.euid, raw);
+		print_delim(fp, del);
+		print_group(fp, tok->tt.subj64.egid, raw);
+		print_delim(fp, del);
+		print_user(fp, tok->tt.subj64.ruid, raw);
+		print_delim(fp, del);
+		print_group(fp, tok->tt.subj64.rgid, raw);
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.subj64.pid, "%u");
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.subj64.sid, "%u");
+		print_delim(fp, del);
+		print_8_bytes(fp, tok->tt.subj64.tid.port, "%llu");
+		print_delim(fp, del);
+		print_ip_address(fp, tok->tt.subj64.tid.addr);
+	}
 }
 
 /*
@@ -2322,29 +3234,59 @@
 
 static void
 print_subject32ex_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "subject_ex", raw);
-	print_delim(fp, del);
-	print_user(fp, tok->tt.subj32_ex.auid, raw);
-	print_delim(fp, del);
-	print_user(fp, tok->tt.subj32_ex.euid, raw);
-	print_delim(fp, del);
-	print_group(fp, tok->tt.subj32_ex.egid, raw);
-	print_delim(fp, del);
-	print_user(fp, tok->tt.subj32_ex.ruid, raw);
-	print_delim(fp, del);
-	print_group(fp, tok->tt.subj32_ex.rgid, raw);
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.subj32_ex.pid, "%u");
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.subj32_ex.sid, "%u");
-	print_delim(fp, del);
-	print_4_bytes(fp, tok->tt.subj32_ex.tid.port, "%u");
-	print_delim(fp, del);
-	print_ip_ex_address(fp, tok->tt.subj32_ex.tid.type,
-	    tok->tt.subj32_ex.tid.addr);
+	print_tok_type(fp, tok->id, "subject_ex", raw, xml);
+	if (xml) {
+		open_attr(fp, "audit-uid");
+		print_user(fp, tok->tt.subj32_ex.auid, raw);
+		close_attr(fp);
+		open_attr(fp, "uid");
+		print_user(fp, tok->tt.subj32_ex.euid, raw);
+		close_attr(fp);
+		open_attr(fp, "gid");
+		print_group(fp, tok->tt.subj32_ex.egid, raw);
+		close_attr(fp);
+		open_attr(fp, "ruid");
+		print_user(fp, tok->tt.subj32_ex.ruid, raw);
+		close_attr(fp);
+		open_attr(fp, "rgid");
+		print_group(fp, tok->tt.subj32_ex.rgid, raw);
+		close_attr(fp);
+		open_attr(fp, "pid");
+		print_4_bytes(fp, tok->tt.subj32_ex.pid, "%u");
+		close_attr(fp);
+		open_attr(fp, "sid");
+		print_4_bytes(fp, tok->tt.subj32_ex.sid, "%u");
+		close_attr(fp);
+		open_attr(fp, "tid");
+		print_4_bytes(fp, tok->tt.subj32_ex.tid.port, "%u");
+		print_ip_ex_address(fp, tok->tt.subj32_ex.tid.type,
+		    tok->tt.subj32_ex.tid.addr);
+		close_attr(fp);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_user(fp, tok->tt.subj32_ex.auid, raw);
+		print_delim(fp, del);
+		print_user(fp, tok->tt.subj32_ex.euid, raw);
+		print_delim(fp, del);
+		print_group(fp, tok->tt.subj32_ex.egid, raw);
+		print_delim(fp, del);
+		print_user(fp, tok->tt.subj32_ex.ruid, raw);
+		print_delim(fp, del);
+		print_group(fp, tok->tt.subj32_ex.rgid, raw);
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.subj32_ex.pid, "%u");
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.subj32_ex.sid, "%u");
+		print_delim(fp, del);
+		print_4_bytes(fp, tok->tt.subj32_ex.tid.port, "%u");
+		print_delim(fp, del);
+		print_ip_ex_address(fp, tok->tt.subj32_ex.tid.type,
+		    tok->tt.subj32_ex.tid.addr);
+	}
 }
 
 /*
@@ -2370,12 +3312,17 @@
 
 static void
 print_text_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "text", raw);
-	print_delim(fp, del);
-	print_string(fp, tok->tt.text.text, tok->tt.text.len);
+	print_tok_type(fp, tok->id, "text", raw, xml);
+	if (xml) {
+		print_string(fp, tok->tt.text.text, tok->tt.text.len);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_string(fp, tok->tt.text.text, tok->tt.text.len);
+	}
 }
 
 /*
@@ -2432,20 +3379,39 @@
 
 static void
 print_socketex32_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "socket", raw);
-	print_delim(fp, del);
-	print_2_bytes(fp, tok->tt.socket_ex32.type, "%#x");
-	print_delim(fp, del);
-	print_2_bytes(fp, ntohs(tok->tt.socket_ex32.l_port), "%#x");
-	print_delim(fp, del);
-	print_ip_address(fp, tok->tt.socket_ex32.l_addr);
-	print_delim(fp, del);
-	print_4_bytes(fp, ntohs(tok->tt.socket_ex32.r_port), "%#x");
-	print_delim(fp, del);
-	print_ip_address(fp, tok->tt.socket_ex32.r_addr);
+	print_tok_type(fp, tok->id, "socket", raw, xml);
+	if (xml) {
+		open_attr(fp, "sock_type");
+		print_2_bytes(fp, tok->tt.socket_ex32.type, "%#x");
+		close_attr(fp);
+		open_attr(fp, "lport");
+		print_2_bytes(fp, ntohs(tok->tt.socket_ex32.l_port), "%#x");
+		close_attr(fp);
+		open_attr(fp, "laddr");
+		print_ip_address(fp, tok->tt.socket_ex32.l_addr);
+		close_attr(fp);
+		open_attr(fp, "faddr");
+		print_ip_address(fp, tok->tt.socket_ex32.r_addr);
+		close_attr(fp);
+		open_attr(fp, "fport");
+		print_2_bytes(fp, tok->tt.socket_ex32.type, "%#x");
+		close_attr(fp);
+		close_tag(fp, tok->id);
+	} else {
+		print_delim(fp, del);
+		print_2_bytes(fp, tok->tt.socket_ex32.type, "%#x");
+		print_delim(fp, del);
+		print_2_bytes(fp, ntohs(tok->tt.socket_ex32.l_port), "%#x");
+		print_delim(fp, del);
+		print_ip_address(fp, tok->tt.socket_ex32.l_addr);
+		print_delim(fp, del);
+		print_4_bytes(fp, ntohs(tok->tt.socket_ex32.r_port), "%#x");
+		print_delim(fp, del);
+		print_ip_address(fp, tok->tt.socket_ex32.r_addr);
+	}
 }
 
 static int
@@ -2469,12 +3435,14 @@
 
 static void
 print_invalid_tok(FILE *fp, tokenstr_t *tok, char *del, char raw,
-    __unused char sfrm)
+    __unused char sfrm, int xml)
 {
 
-	print_tok_type(fp, tok->id, "unknown", raw);
-	print_delim(fp, del);
-	print_mem(fp, tok->tt.invalid.data, tok->tt.invalid.length);
+	if (!xml) {
+		print_tok_type(fp, tok->id, "unknown", raw, 0);
+		print_delim(fp, del);
+		print_mem(fp, tok->tt.invalid.data, tok->tt.invalid.length);
+	}
 }
 
 
@@ -2607,7 +3575,7 @@
 }
 
 /*
- * 'prints' the token out to outfp
+ * 'prints' the token out to outfp.
  */
 void
 au_print_tok(FILE *outfp, tokenstr_t *tok, char *del, char raw, char sfrm)
@@ -2615,151 +3583,309 @@
 
 	switch(tok->id) {
 	case AUT_HEADER32:
-		print_header32_tok(outfp, tok, del, raw, sfrm);
+		print_header32_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_HEADER32_EX:
+		print_header32_ex_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_HEADER64:
+		print_header64_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_HEADER64_EX:
+		print_header64_ex_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_TRAILER:
+		print_trailer_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_ARG32:
+		print_arg32_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_ARG64:
+		print_arg64_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_DATA:
+		print_arb_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_ATTR32:
+		print_attr32_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_ATTR64:
+		print_attr64_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_EXIT:
+		print_exit_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_EXEC_ARGS:
+		print_execarg_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_EXEC_ENV:
+		print_execenv_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_OTHER_FILE32:
+		print_file_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_NEWGROUPS:
+		print_newgroups_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_IN_ADDR:
+		print_inaddr_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_IN_ADDR_EX:
+		print_inaddr_ex_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_IP:
+		print_ip_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_IPC:
+		print_ipc_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_IPC_PERM:
+		print_ipcperm_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_IPORT:
+		print_iport_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_OPAQUE:
+		print_opaque_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_PATH:
+		print_path_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_PROCESS32:
+		print_process32_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_PROCESS32_EX:
+		print_process32ex_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_RETURN32:
+		print_return32_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_RETURN64:
+		print_return64_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_SEQ:
+		print_seq_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_SOCKET:
+		print_socket_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_SOCKINET32:
+		print_sock_inet32_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_SOCKUNIX:
+		print_sock_unix_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_SUBJECT32:
+		print_subject32_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_SUBJECT64:
+		print_subject64_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_SUBJECT32_EX:
+		print_subject32ex_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_TEXT:
+		print_text_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	case AUT_SOCKET_EX:
+		print_socketex32_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+		return;
+
+	default:
+		print_invalid_tok(outfp, tok, del, raw, sfrm, AU_PLAIN);
+	}
+}
+
+/*
+ * 'prints' the token out to outfp in XML format.
+ */
+void
+au_print_tok_xml(FILE *outfp, tokenstr_t *tok, char *del, char raw,
+    char sfrm)
+{
+
+	switch(tok->id) {
+	case AUT_HEADER32:
+		print_header32_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_HEADER32_EX:
-		print_header32_ex_tok(outfp, tok, del, raw, sfrm);
+		print_header32_ex_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_HEADER64:
-		print_header64_tok(outfp, tok, del, raw, sfrm);
+		print_header64_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_HEADER64_EX:
-		print_header64_ex_tok(outfp, tok, del, raw, sfrm);
+		print_header64_ex_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_TRAILER:
-		print_trailer_tok(outfp, tok, del, raw, sfrm);
+		print_trailer_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_ARG32:
-		print_arg32_tok(outfp, tok, del, raw, sfrm);
+		print_arg32_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_ARG64:
-		print_arg64_tok(outfp, tok, del, raw, sfrm);
+		print_arg64_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_DATA:
-		print_arb_tok(outfp, tok, del, raw, sfrm);
+		print_arb_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_ATTR32:
-		print_attr32_tok(outfp, tok, del, raw, sfrm);
+		print_attr32_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_ATTR64:
-		print_attr64_tok(outfp, tok, del, raw, sfrm);
+		print_attr64_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_EXIT:
-		print_exit_tok(outfp, tok, del, raw, sfrm);
+		print_exit_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_EXEC_ARGS:
-		print_execarg_tok(outfp, tok, del, raw, sfrm);
+		print_execarg_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_EXEC_ENV:
-		print_execenv_tok(outfp, tok, del, raw, sfrm);
+		print_execenv_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_OTHER_FILE32:
-		print_file_tok(outfp, tok, del, raw, sfrm);
+		print_file_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_NEWGROUPS:
-		print_newgroups_tok(outfp, tok, del, raw, sfrm);
+		print_newgroups_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_IN_ADDR:
-		print_inaddr_tok(outfp, tok, del, raw, sfrm);
+		print_inaddr_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_IN_ADDR_EX:
-		print_inaddr_ex_tok(outfp, tok, del, raw, sfrm);
+		print_inaddr_ex_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_IP:
-		print_ip_tok(outfp, tok, del, raw, sfrm);
+		print_ip_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_IPC:
-		print_ipc_tok(outfp, tok, del, raw, sfrm);
+		print_ipc_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_IPC_PERM:
-		print_ipcperm_tok(outfp, tok, del, raw, sfrm);
+		print_ipcperm_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_IPORT:
-		print_iport_tok(outfp, tok, del, raw, sfrm);
+		print_iport_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_OPAQUE:
-		print_opaque_tok(outfp, tok, del, raw, sfrm);
+		print_opaque_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_PATH:
-		print_path_tok(outfp, tok, del, raw, sfrm);
+		print_path_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_PROCESS32:
-		print_process32_tok(outfp, tok, del, raw, sfrm);
+		print_process32_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_PROCESS32_EX:
-		print_process32ex_tok(outfp, tok, del, raw, sfrm);
+		print_process32ex_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_RETURN32:
-		print_return32_tok(outfp, tok, del, raw, sfrm);
+		print_return32_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_RETURN64:
-		print_return64_tok(outfp, tok, del, raw, sfrm);
+		print_return64_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_SEQ:
-		print_seq_tok(outfp, tok, del, raw, sfrm);
+		print_seq_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_SOCKET:
-		print_socket_tok(outfp, tok, del, raw, sfrm);
+		print_socket_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_SOCKINET32:
-		print_sock_inet32_tok(outfp, tok, del, raw, sfrm);
+		print_sock_inet32_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_SOCKUNIX:
-		print_sock_unix_tok(outfp, tok, del, raw, sfrm);
+		print_sock_unix_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_SUBJECT32:
-		print_subject32_tok(outfp, tok, del, raw, sfrm);
+		print_subject32_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_SUBJECT64:
-		print_subject64_tok(outfp, tok, del, raw, sfrm);
+		print_subject64_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_SUBJECT32_EX:
-		print_subject32ex_tok(outfp, tok, del, raw, sfrm);
+		print_subject32ex_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_TEXT:
-		print_text_tok(outfp, tok, del, raw, sfrm);
+		print_text_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	case AUT_SOCKET_EX:
-		print_socketex32_tok(outfp, tok, del, raw, sfrm);
+		print_socketex32_tok(outfp, tok, del, raw, sfrm, AU_XML);
 		return;
 
 	default:
-		print_invalid_tok(outfp, tok, del, raw, sfrm);
+		print_invalid_tok(outfp, tok, del, raw, sfrm, AU_XML);
 	}
 }
 
