audit: restore order of tty and ses fields in log output