Has someone done some work related to the performance impact of enabling auditd on syscalls watching?