Here's what keeps the code readable: https://jenkins.osquery.io/job/osqueryPullRequestAudit/ Starting from here: http://osquery.readthedocs.io/en/stable/deployment/process-auditing/#linux-process-auditing You'll also need to optimize audit's settings, they make the largest difference from the server's performance perspective. However, when I evaluate osquery's audit performance I compare to

auditd

.