before run osquery, auditctl -l returns no rules....
# general
v
before run osquery, auditctl -l returns no rules.. so I am usign auditd only with osquery