AUDIT_FILTER_USER
err = audit_filter(msg_type, AUDIT_FILTER_USER);
case AUDIT_FILTER_USER:
entry->rule.listnr != AUDIT_FILTER_USER)