Use fread_unlocked for speed.
Prettify some parts of the code.
Set the havejson match on the SYSCALL record type only, we don't want partial records with EXECVE.
Added comment that explains why this may happen - this can be fixed by libaudit or the kernel.