You have to match each connection you see with strace with the correct record from audit to see what's going on