@mellven, 8616 is not captured because of, this process is already running before you installed osquery. The general concept of audit is any process which existed before auditd or osqueryd started will not generate the events. To avoid this you need to reboot your kernel with 'audit=1' option as the kernel command line. Make change in the grub file. Please check on the net how to do that. Other way is to install osqueryd as service and reboot the machine with osquery audit flags enabled. If osqueryd comes up before any other process then later process will be audited. Again in-order to capture an event , osquery has to be already running.