my recommendation would be if you're going to use osquery for process auditing, just remove auditd entirely