@npamnani ah ok, so if I enable auditd fim osquery also uses inotify, I will open an issue because have both enabled has a performance impact