Audit log decode