auditbeat/docs/modules: remove incorrect advice in documentation (#37175

)

The documentation incorrectly states that socket selection of multicast
that cannot be satisfied will fall back to unicast. So remove this
claim.

(cherry picked from commit 867be3b)

CHANGELOG.next.asciidoc

@@ -34,6 +34,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 
 *Auditbeat*
 
+- Fix documentation regarding socket type selection. {issue}37174[37174] {pull}37175[37175]
 
 *Filebeat*
 

auditbeat/docs/modules/auditd.asciidoc

@@ -153,8 +153,7 @@ stopped (e.g. stop `auditd`).
 `multicast` can be used in kernel versions 3.16 and newer. By using `multicast`
 {beatname_uc} will receive an audit event broadcast that is not exclusive to a
 a single process. This is ideal for situations where `auditd` is running and
-managing the rules. If `multicast` is specified, but the kernel version is less
-than 3.16 {beatname_uc} will automatically revert to `unicast`.
+managing the rules.
 +
 By default {beatname_uc} will use `multicast` if the kernel version is 3.16 or
 newer and no rules have been defined. Otherwise `unicast` will be used.

auditbeat/module/auditd/_meta/docs.asciidoc

@@ -146,8 +146,7 @@ stopped (e.g. stop `auditd`).
 `multicast` can be used in kernel versions 3.16 and newer. By using `multicast`
 {beatname_uc} will receive an audit event broadcast that is not exclusive to a
 a single process. This is ideal for situations where `auditd` is running and
-managing the rules. If `multicast` is specified, but the kernel version is less
-than 3.16 {beatname_uc} will automatically revert to `unicast`.
+managing the rules.
 +
 By default {beatname_uc} will use `multicast` if the kernel version is 3.16 or
 newer and no rules have been defined. Otherwise `unicast` will be used.