So, my C++ is pretty bare, anyone able to confirm that if

audit_allow_config

is set to

false

in https://github.com/facebook/osquery/blob/2.10.0/osquery/events/linux/audit.cpp,

osqueryd

will stop telling the kernel which PID to send audit events to?