Hi there! From the official documentation I got

Auditd should not be running when using osquery's process auditing, as it will conflict with osqueryd over access to the audit netlink socket.

but on whose side is the problem? I enabled process auditing and it turned out that raw audit logs got collected by journald (and enormously raised IO btw). Is it ok and the problem is in auditd and other apps can still get records from audit netlink socket without any conflicts with osquery? Have anyone researched that?