the only trouble is that ideally you don't want osquery-related audit messages to end up inside other programs