@groob... and this is all I see in /var/log/osquery/osqueryd.info: I0717 171017.616297 6183 events.cpp:863] Event publisher not enabled: auditeventpublisher: Publisher disabled via configuration I0717 171017.616425 6183 events.cpp:863] Event publisher not enabled: syslog: Publisher disabled via configuration