audit: cull redundancy in audit_rule_change