osquery and auditd do not play well together