audit: rework audit_log_start()