Hi osquery team, i setup a FIM through fleet UI like overrides: platforms: all: file_paths: etc: - /etc/osquery/% exclude_paths: tmp: - /tmp/too_many_events/ homes: - /home/not_to_monitor/.ssh/%% and i can see that cfg has been pushed to agent side but it doesn't work as expected when i creating new file under the cfg folder, there is no event generated in file_events table. And i found some err in the system log of osquery Oct 14 013259 n121-038-121 osqueryd[563006]: {"data":[{"hostIdentifier":"XXX","calendarTime":"Fri Oct 14 013247 2022 UTC","unixTime":"1665711167","severity":"0","filename":"auditdnetlink.cpp","line":"745","message":"*Malformed audit record received*","version":"5.4.0-dirty","decorations":{"host_uuid":"XXX","hostname":"XXX"}},{"hostIdentifier":"XXX","calendarTime":"Fri Oct 14 013247 2022 UTC","unixTime":"1665711167"I1014 013259.163120 563128 config.cpp:1238] Refreshing configuration state Does it mean the audit did not begins as expected? And how to fix it?