audit: CONFIG_CHANGE don't log internal bookkeeping as an event