osquery process events conflicts with auditd on linux, see https://osquery.readthedocs.io/en/stable/deployment/process-auditing/#linux-process-auditing