@theopolis - Yeah from my testing with osquery 2.10.0, if I have

audit_allow_config

, osqueryd stops adding the rules but looking at

auditctl -s

the

pid

is also

0

(and there’s no socket_events either)