@nebi, full command line is "sudo osqueryi --audit_allow_config=true --disable_audit=false --disable_events=false" and make sure auditd is not running