no sure, but we are not doing any additional work when displaying audit events; we are not evaluating the socket fd to then get additional information about the scocket fd, which btw could be out of date, because it won’t be inline with the event