but with osquery I see that enabling audit_allow_fim_events a lot of not really fim related syscalls are enabled and kills my machines