[RFC PATCH v1] audit: log AUDIT_TIME_* records only from rules