@obelisk, here is an example from audit pipe showing the /dev/null path. looks like this is what OpenBSM is returning. any idea if its even possible to work around this with audit_control config changes?