After ONTAP upgrade EMS shows auditlog.change.detected
Applies to
ONTAP 9.12.1+ without fix for bug 1524672
Issue
Event log shows 
auditlog.change.detected  errors:::> event log show -event *aud*
Time                Node             Severity      Event
------------------- ---------------- ------------- ---------------------------
1/19/2023 00:05:00  cluster1-02      ERROR         auditlog.change.detected: Audit log file "audit.log.0000000002" was tampered with.
