We should also (see whether we should) add audit hooks for the following modules:
* configparser
* crypt
* ensurepip
* ftplib
* glob
* http
* imaplib
* nntplib
* pdb
* poplib
* runpy
* shutil
* smtpd
* smtplib
* socketserver
* sqlite3
* telnetlib
* webbrowser
* xmlrpc

All of these seem likely to have interesting events (specifically, they can all be misused in scenarios where the impact would not be obvious without extra information).

PR 14301 has at least a few hooks for most of the modules above.

I think xmlrpc deserves some, but it is not as immediately obvious where to put them as for the other modules. smtpd also still needs looking at.

I'll add hooks to ssl module for wrap_socket and wrap_bio.

New changeset 60419a7e96577cf783b3b45bf3984f9fb0d7ddff by Steve Dower in branch 'master':
bpo-37363: Add audit events for a range of modules (GH-14301)
https://github.com/python/cpython/commit/60419a7e96577cf783b3b45bf3984f9fb0d7ddff

New changeset 8763d43a9558b345af6a3a298afa18e7d3b42fd0 by Miss Islington (bot) in branch '3.8':
bpo-37363: Add audit events for a range of modules (GH-14301)
https://github.com/python/cpython/commit/8763d43a9558b345af6a3a298afa18e7d3b42fd0

FWIW, I tried looking into how we can prevent or detect monkeypatching of "sys.audit", and the answer seems to be that we need to define a custom type for the sys module and for sys.__dict__.

I'm not prepared to do that yet, and IMHO there are enough way to detect someone patching it to nothing (all your logs disappear) or patching it more cleverly (someone ran some pretty complex code to redefine it) and events from native code can't be suppressed either, so I think it's fine. 

But I won't refuse a contribution if someone thinks this is a critical scenario (though I will push hard to make sure the implementation is solid, as I think this is pretty hard to get right).

New changeset e226e83d36dfc7220d836fb7a249ce18e70cb4a6 by Steve Dower in branch 'master':
bpo-37363: Add audit events on startup for the run commands (GH-14524)
https://github.com/python/cpython/commit/e226e83d36dfc7220d836fb7a249ce18e70cb4a6

New changeset 746992c1ae4c632220563d3fe54123498f93db1d by Miss Islington (bot) in branch '3.8':
bpo-37363: Add audit events on startup for the run commands (GH-14524)
https://github.com/python/cpython/commit/746992c1ae4c632220563d3fe54123498f93db1d

All that's left here right now is some xmlrpc events, unless we can think of any more stdlib modules that should have them?

New changeset ed4b3216e59df4806e5ef63b3357fc577a9443d7 by Miss Islington (bot) (Christian Heimes) in branch 'master':
bpo-37363: Document internal audit events (GH-14663)
https://github.com/python/cpython/commit/ed4b3216e59df4806e5ef63b3357fc577a9443d7

New changeset 2f01cf61874aa42eeb9999e49d51d4881792d9c4 by Miss Islington (bot) in branch '3.8':
bpo-37363: Document internal audit events (GH-14663)
https://github.com/python/cpython/commit/2f01cf61874aa42eeb9999e49d51d4881792d9c4

@Christian, I have merged your PR for the audit events, but I have not closed this issue, I suppose there will be other PRs for this issue.

Hi @Christian,

When you have time for my last question.

Thank you,

New changeset 927b841c215a1ca36c9b3203eadc67ce05b1ed07 by Saiyang Gou in branch 'master':
bpo-37363: Add audit events to the `http.client` module (GH-21321)
https://github.com/python/cpython/commit/927b841c215a1ca36c9b3203eadc67ce05b1ed07

the http module is covered by the audit events