@Syeda Fatima Navaid I don't think they are necessarily messages to worry about. The

--verbose

flag is a troubleshooting/debugging flag, you shouldn't have it enabled normally. As you can see the message, before the timestamp, start with an

I

not an

E

. That been said, the

FRN pathname lookup failed

is a known issue for that specific table that have its workaround. The comment in the code + the message: https://github.com/osquery/osquery/blob/76c7733a750a06d7f6920936863e4f959aaf2570/osquery/events/windows/ntfs_event_publisher.cpp#L535-L545 And the issue mentioning it https://github.com/osquery/osquery/issues/5848 The other message I'm not sure, but it being again a verbose message doesn't necessarily mean it's an issue. I would start the other way, do you have a specific issue with the values shown by the table? Is something missing?