Because it’s inserting the generic audit rules to just get all `connect`/`bind`/`execve` syscalls, and nagios does a whole lot of those