When the capset syscall is used it is not possible for audit to record the