diff --git a/osquery/events/linux/auditnetlink.cpp b/osquery/events/linux/auditnetlink.cpp
diff --git a/osquery/events/linux/auditnetlink.h b/osquery/events/linux/auditnetlink.h
@@ -27,8 +27,8 @@ struct AuditEventRecord final {
   /// Event time.
   unsigned long int time;
 
-  /// Audit event id that owns this record.
-  unsigned long int audit_id;
+  /// Audit event id that owns this record. Remember: PRIMARY KEY(id, timestamp)
+  std::string audit_id;
 
   /// The field list for this record.
   std::map<std::string, std::string> fields;
@@ -75,6 +75,10 @@ class AuditNetlink final {
   /// Set to true by ::terminate() when the thread should exit.
   std::atomic<bool> terminate_thread_{false};
 
+  /// This is the set of rules we have applied when configuring the service.
+  /// This is also what we need to remove when exiting.
+  std::vector<int> monitored_syscall_list_;
+
  public:
   static AuditNetlink& getInstance();
   ~AuditNetlink();
@@ -95,7 +99,7 @@ class AuditNetlink final {
       NetlinkSubscriptionHandle handle) noexcept;
 
  private:
-  AuditNetlink();
+  AuditNetlink() = default;
 
   /// Starts the event receiver thread.
   bool start() noexcept;
@@ -106,6 +110,12 @@ class AuditNetlink final {
   /// Reads as many audit event records as possible before returning.
   bool acquireMessages() noexcept;
 
+  /// Configures the audit service and applies required rules
+  bool configureAuditService() noexcept;
+
+  /// Removes
+  void restoreAuditServiceConfiguration() noexcept;
+
   /// (Re)acquire the netlink handle.
   NetlinkStatus acquireHandle() noexcept;
 

diff --git a/osquery/tables/events/linux/auditd_file_events.cpp b/osquery/tables/events/linux/auditd_file_events.cpp
@@ -26,6 +26,11 @@ namespace boost_fs = boost::filesystem;
 
 namespace osquery {
 
+FLAG(bool,
+     audit_allow_file_events,
+     false,
+     "Allow the audit publisher to install file event monitoring rules");
+
 #define AUDIT_SYSCALL_READ 0
 #define AUDIT_SYSCALL_WRITE 1
 #define AUDIT_SYSCALL_OPEN 2

diff --git a/osquery/tables/events/linux/process_events.cpp b/osquery/tables/events/linux/process_events.cpp
@@ -17,6 +17,11 @@
 
 namespace osquery {
 
+FLAG(bool,
+     audit_allow_process_events,
+     false,
+     "Allow the audit publisher to install process event monitoring rules");
+
 #define AUDIT_SYSCALL_EXECVE 59
 
 // Depend on the external getUptime table method.