it happens because you are using both auditd and o...
# general
a
it happens because you are using both auditd and osquery with --disable_audit=false