anyone have experience using auditd. I'm sorta getting some pushback on auditd vs osquery. How performant is osquery's process/socket auditing on linux compared to auditd?