what is happening in your machine is that osquery and auditd are fighting over who should be the reader of those events