osquery> select * from osquery_events where active = 1; +-----------------+---------------------+------------+---------------+--------+-----------+--------+ | name | publisher | type | subscriptions | events | refreshes | active | +-----------------+---------------------+------------+---------------+--------+-----------+--------+ | inotify | inotify | publisher | 0 | 0 | 43 | 1 | | udev | udev | publisher | 1 | 0 | 43 | 1 | | file_events | inotify | subscriber | 0 | 0 | 0 | 1 | | hardware_events | udev | subscriber | 1 | 0 | 0 | 1 | | process_events | auditeventpublisher | subscriber | 1 | 0 | 0 | 1 | | socket_events | auditeventpublisher | subscriber | 1 | 0 | 0 | 1 | | syslog_events | syslog | subscriber | 1 | 0 | 0 | 1 | | user_events | auditeventpublisher | subscriber | 1 | 0 | 0 | 1 | | yara_events | inotify | subscriber | 0 | 0 | 0 | 1 | +-----------------+---------------------+------------+---------------+--------+-----------+--------+