audit: update AUDIT_INODE filter rule to comparator function