yeah, but it seems that only file_events is filled and not process_file_events, so it is using inotify and not auditd