@alessandrogario VMWare pre-configures the auditd settings for you and you can ship events off via syslog. The problem is auditd logs in their standard format end up getting split up as they are multiline events, which makes them hard to work with in our logging system since it only has pretty basic searching. On our other systems we were instead just using OSQuery for the same tasks as the output and setup was way nicer, plus much more stuff. However apparently VMWare is now taking the stance of removing any third party stuff when they feel like it if the team needs support.