audit: reduce scope of audit_log_fcaps