audit: move calcs after alloc and check when logging set loginuid