hey @theopolis i'm reading https://slack.engineering/syscall-auditing-at-scale-e6a3ca8ac1b8#.rakizljrt by @rhuber:

Osquery is great. In fact, we use it at Slack. For our production servers, we prefer go-audit because these systems are connected 24/7, which allows us to stream data constantly. With osquery, you are generally receiving a snapshot of the current machine state. If something runs to completion between polling intervals, you might miss it. I think this model works well for laptops and other employee endpoints, but I prefer a stream of data for highly-available machines.

didn't you make an auditd log target in osquery which streamed syscalls to an event-based table?