[PATCH] fix missed create event for directory audit