You may have tried this already, but you need to pass a command line flag to enable events: https://osquery.readthedocs.io/en/stable/installation/cli-flags/#events-control-flags