[RFC PATCH 6/9] audit: rework audit_log_start()