I am having a lot of performance issues with fim and auditd (audit_allow_fim_events), I can use inotify but the limit is that I can't match the event with the process. Is this possible only with auditd?