That's fine. Another problem I have is that we want to use AppArmor. It requires auditd to be running to work and that OSQuery doc says you can't do process auditing with OSQuery if auditd is running. So, I won't be able to use those features of OSQuery. But thanks for all your help with those SQL queries! Those I can definitely use