<@U024MCU489H> The query you are using returns res...
# general
s
@Jason NG The query you are using returns results that are always the same between runs. The differential logging sees that and avoids outputting the rows, since they are identical. Keep in mind that the very first time you run the query through scheduling, that has been saved in the database, so every subsequent run using the same database, would always make a diff against those saved results, and so you won't have any output. You can try deleting the database and re-run osquery, you should then see a message like this:
20210610 11:48:20.366848 47894 query.cpp:113] Storing initial results for new scheduled query: system_info
And then you would see your results logged in the results file, but only once