i'm trying to figure out how costly it is to set flush=sync vs incremental in auditd.conf. In theory, it would seem like it is more expensive, but by how much? At what level of paranoia about not losing audit logs does it make sense to use flush=sync or is it not much more costly and one might as well use that setting? Thoughts?