MB-56674: Disabled audit filter incorrectly create audit events

The disabled audit filter would incorrectly mark all
internal events as subject for auditing and cause it
to generate a JSON object for them including a timestamp
before discarding the object

Change-Id: I6fff1429582fb4b796604cc76827ac2356c58aee
Reviewed-on: https://review.couchbase.org/c/kv_engine/+/190172
Reviewed-by: Dave Rigby <[email protected]>
Tested-by: Build Bot <[email protected]>

Author: trondn

auditd/src/audit_event_filter.cc

@@ -312,7 +312,7 @@ class DisabledEventFilter : public AuditEventFilter {
                        std::optional<std::string_view> bucket,
                        std::optional<ScopeID> scope,
                        std::optional<CollectionID> collection) const override {
-        return false;
+        return true;
     }
 
 protected:

auditd/tests/audit_event_filter_test.cc

@@ -130,3 +130,9 @@ TEST(AuditEventFilterTest, isFilteredOut) {
                                        {},
                                        {}));
 }
+
+TEST(AuditEventFilterTest, isFilteredOut_DisabledFilter) {
+    auto filter = AuditEventFilter::create(AuditImpl::generation.load(), {});
+    EXPECT_TRUE(filter->isFilteredOut(
+            MEMCACHED_AUDIT_DOCUMENT_READ, {}, {}, {}, {}, {}));
+}