audit: fix event coverage of AUDIT_ANOM_LINK