audit: log on errors from filter user rules