AUDIT: Unify auid reporting, put arch before syscall number