Using "Service Control Monitor" to create SAM monitors causes the audit even as the user "system", I would really like it if the event would be logged as the user who has Service Control Monitor open.