openat syscall should be audited by process_file_events, but it seems to be not. touch file is not recorded