you can put

logger_plugin

,

disable_events

in .conf but i think audit flags have to go to flags file. try adding them to .conf and kick off service in verbose

sudo osqueryd --verbose