Is it possible to get audit events from this early boot?  Maybe audit to the network?  (Though with a quick look at http://people.redhat.com/sgrubb/audit/ I don't see that)