sanitize audit_log_capset()