@b0l there is a pending pull request (for a long time) that will immediately send the events to TLS logger without requiring scheduled queries. If you are using a different logger it is not applicable. Take a look at: https://github.com/facebook/osquery/pull/3482