@obelisk just want to get this issue on the radar — TL;DR is that upgrading from 2.11.0 -> 3.2.x seems to break auditing due to what appears to be a database incompatibility. I have many hosts currently in this state, but will try to independently repro this in a VM tonight. If there’s anything i can provide to help you guys debug, lmk https://github.com/facebook/osquery/issues/4615