"realdn" in auditlog