AUDIT_REC_HEADER
node = malloc(AUDIT_REC_HEADER + DEFAULT_BUF_SZ);
node = realloc(node, AUDIT_REC_HEADER + new_length);
node = malloc(AUDIT_REC_HEADER + new_length);