is it generally not best practice to enable audit events for osquery?