Coming back with some extra questions @alessandrogario 1) Is there a reason these were hardcoded? https://github.com/osquery/osquery/blob/master/osquery/events/linux/auditdnetlink.cpp#L304 — I know you can manage your own audit config file but it sounds like it would be useful to have them configurable while still keeping osquery as the manager of audit’s configuration. 2) Also regarding

enforce sane minimums: -b 8192 -e 100

It seems like you eventually picked half of that backlog size, was this based just on experience? And I think the latter param is a typo? Was that supposed to be an

-r

for rate limit? Osquery doesn’t set a rate limit though correct?