Comment 16 for bug 388746

What does having the events in the audit log buy us above & beyond the events already in utmp/wtmp?