listening to /dev/audit in a pthread program