@Hugh (Zercurity)... in my experience on Ubuntu and CentOS thus far, OSQuery seems to ignore the osquery.flags file. I have to set the options in osquery.conf. This is what I am currently using, but I'm not seeing anything in process_events or user_events: "options": { "config_plugin": "filesystem", "logger_plugin": "filesystem", "logger_path": "/var/log/osquery", "schedule_splay_percent": "10", "database_path": "/var/osquery/osquery.db", "utc": "true", "disable_events": "false", "audit_allow_config": "true", "audit_allow_process_events": "true", "audit_allow_sockets": "true", "audit_allow_user_events": "true", "events_expiry": "3600", "events_optimize": "true", "disable_audit": "true", "events_max": "500000" }, I'm using an audit.rules file that I generated from the CIS benchmarks.