nope, I think you're right on that front. auditd/go-audit just result in logs that are too hard to deal with