but it shouldn't have any more overhead than auditd itself, less than most deployments, since i believe the process publisher on linux actually makes itself the log ingestion point so the logs never hit the filesystem