@groob Sure. I'm trying to understand current working of osquery before opening up issue