We also have a thread here somewhere where people were discussing other ways to get auditd events... to allow for other consumers. I can't find the thread