How does one get USER_CMD records into the audit.log?