tldr is that go-audit was originally written because process auditing in osquery wasn't fast enough to keep up at high volumes