RFE: show change of enforcing state in log ?