it seems that osquery is missing those events, I can see them if I run auditd and check the logs