Remark for history: i made an experiment, in which i compiled my own version of auditbeat, but with commented out lines 304-307 in audit_linux.go (where auditbeat tries to enable auditing in multicast mode). And with these "patch" i never have original error on older systems 
I still test my build on various distros, even older than debian 10, just for verification of some rare use-cases