diff --git a/x-pack/auditbeat/processors/sessionmd/types/process.go b/x-pack/auditbeat/processors/sessionmd/types/process.go
index ee05206636d..a437f35310f 100644
--- a/x-pack/auditbeat/processors/sessionmd/types/process.go
+++ b/x-pack/auditbeat/processors/sessionmd/types/process.go
@@ -451,7 +451,6 @@ func (p *Process) ToMap() mapstr.M {
 	if p.End != nil {
 		process.Put("end", p.End)
 	}
-	// TODO: are other Ends needed, ancestors shouldn't end before process
 
 	return process
 }
diff --git a/x-pack/auditbeat/seccomp_linux.go b/x-pack/auditbeat/seccomp_linux.go
index 00184b409e0..4eb0529def0 100644
--- a/x-pack/auditbeat/seccomp_linux.go
+++ b/x-pack/auditbeat/seccomp_linux.go
@@ -27,7 +27,6 @@ func init() {
 
 		// The system/socket dataset uses additional syscalls
 		if err := seccomp.ModifyDefaultPolicy(seccomp.AddSyscall,
-			"eventfd2",
 			"mount",
 			"mq_open", // required for creds kprobe guess trigger.
 			"perf_event_open",