@groob oh seems snapshot query/log is working too. It is coming to C:\ProgramData\osquery\log\osqueryd.snapshots.log