Only collect the first message of audit log - refs: #12