we'd obviously rather use process_events for many reasons, however we noticed that in 2.9.0 using OpenBSM/audit_control, that there is no "name" column and the "path" column is very often /dev/null.