@Lucas Rodriguez: I left a comment with a couple of notes, but I totally misremembered what was available as filtering via audit rules. So it's not possible to filter by path in the rules, when auditing those syscalls, my bad.