If the audit messages would shift up 1 from the first_event you could track the performance of the audit daemon. Having 2 messages typed with the same number is confusing.