Audit config changes don't show correct user

Vulcan build 1971

When making a change to audit settings, the user is listed as couchbase/internal:

{"timestamp":"2018-02-23T14:28:33.586991Z","real_userid":{"source":"internal","user":"couchbase"},"auditd_enabled":true,"descriptors_path":"/opt/couchbase/etc/security","hostname":"ip-10-0-183-117","log_path":"/opt/couchbase/var/lib/couchbase/logs","rotate_interval":172800,"version":2,"uuid":"46744543","id":4096,"name":"configured audit daemon","description":"loaded configuration file for audit daemon"}

We really need a way of identifying which admin user made this change.