@sundsta... the docs say that osquery and auditd compete for exclusive access to the kernel security module. But even with auditd disabled, I was seeing mangled events until I removed the package completely.