on macos, without any kernel extension only process events are collected, right?