@nNipsx Not entirely sure how you'd do that with osquery, some others might have better insight, but we are using syslog to get this information