As for the added/removed rows, that's the differential engine at work: https://osquery.readthedocs.io/en/latest/deployment/logging/#differential-logs At each query it compares what the last query result was and shows you the difference only.