@Dougr can you elaborate more on that? Does that mean that you can get the auditd events from a VMware VM?