I'm also noticing that process_events are not picking up failed events. Like if a non-privileged user runs adduser or addgroup, I don't see anything from either syslog or OSQuery. Is there any way for OSQuery to track failed process events?