@Mutaz @alessandrogario, wrt audispd, we (Uptycs) have added support for that to osquery, and have it in production at our customers' across 10's of thousands of nodes, doing of the order of millions of events per day. With this, osquery coexists with auditd. Now that there is a path forward wrt PRs and submissions, we'll work to get this PR out asap.