Cisco firewall change audit: fix the diff, not the log

Cisco firewall change audits usually reconstruct who changed what. Here is how to reconcile config, AAA and hit-count data into findings that survive review.