what audit rules are generating the data seen in the user_events table? Is that data just a side effect of the rule monitoring execve?