Audit: collect sessionid in netlink messages