I'm using the following config in an attempt to get all of the "_events" tables working: "options": { "config_plugin": "filesystem", "logger_plugin": "filesystem", "logger_path": "/var/log/osquery", "schedule_splay_percent": "10", "database_path": "/var/osquery/osquery.db", "utc": "true", "disable_events": "false", "events_expiry": "3600", "events_optimize": "true", "disable_audit": "false", "audit_allow_fim_events": "true", "audit_allow_config": "true", "audit_allow_process_events": "true", "audit_allow_sockets": "true", "audit_allow_user_events": "true", "audit_persist": "true", "audit_force_reconfigure": "true", "audit_force_unconfigure": "true", "events_max": "500000" }, When I run "select * from osquery_events where active=1", I see subscriber=1 for all of the "_events" tables except for yara_events (which I'm not using). But "file_events" is the only one that is working. The auditeventpublisher shows as having 4 subscriptions, but zero events. Any idea why auditeventpublisher isn't seeing events? Auditd is disabled. If I try and start auditd it crashes, presumably because osquery is occupying the audit socket. I'd love some help on this one...