What does "---" in audit.log timestamp / event-id field mean?