Audit: move audit_get_nd completely into audit_watch