hi,when I use osquery to get the audit events log.and I set the

audit_allow_config=true

to use my own audit rules.at first the auditd status is good which means that the auditd is enabled and the pid is the osquery's pid. but when osquery runs a while,the auditd status will become not enabled,but it'pid is still the osquery's pid.so what is the root cause?