audit: allow checking the type of audit message in the user filter