remove struct audit_message?