After we get a SIGTERM, we want to set a timer for 2 seconds and call do_auditing() to let the auditsvc syscall write as many records as it can until the timer goes off (at which point it returns to auditd with SIGALRM.