I’m trying to debug something but it’s hard, osquery drops some audit types as well: https://github.com/osquery/osquery/blob/master/osquery/events/linux/auditdnetlink.cpp#L77 so it’s difficult to see a timeline of events as seen/generated by audit