@alessandrogario - Nope, I explicitly turn that off unless I need to verify some audit things, then I stop osqueryd and switch to auditd temporarily