Ah yeah, I should have been more specific, I have

audit_allow_sockets

enabled but, I want to manage the specific audit rules separately. The context here is that nginx is causing thousands and thousands of

connect

actions, so I want to configure the audit rule itself to not forward those events to osquery.