New field seen in audit.log