@zwass, @clong, sorry today is a bit stuck… reading 4615 now. I can try the way of renaming the db file and test again. I can see only syslog is not working while process_events and socket_events are working fine on both osqueryi and osqueryd.