@Stefano Bonicatti — good thought. It might just need some quoting @Jason — Then it’s not an inherent issue with osquery, and you need logs for more clarity