Audit record emission

Hi, I was looking into a problem from the test team and ran across this comment in the kernel code: http://lxr.linux.no/source/kernel/auditsc.c#L652 It basically says that audit records may be emitted as event records are generated as opposed to syscall exit. The problem shows up during stress testing. The records that get sent from the kernel are no where close to each other and are hard to correlate. The comment says that if the current technique isn't suitable, maybe we can keep formatted records off of the context and then send them all at syscall exit. Can anyone see any problems with changing this? -Steve