@alessandrogario fim with inotify is better as performances, but I can't map the process name with the file events, this is the only reason to use fim with auditd in my use case