By audit you mean log right? not the audits we display in UI or is that the goal?

In MaaS you really see it in a host detail (node detail) on events page (we have audits for the same). So I was really thinking Foreman audits table, with host associated records so we can show them easily per-host.

I still think that all audits are subject of storing outside of RDBM, I know there is some extra work around associations but we have grown by far out of scope of the audited gem. But this is a different topic :-)

I love this feature, would really help to see what happens under the hood. Ideally, we could also enrich this data with access to templates, e.g. what https://github.com/ShimShtein/foreman_build_history does.

We actually don't need to sniff network packets to get the dhcp information. dhcpd can call scripts when certain events happen.