install default osquery, steal systemd service file, you're good on most recent linux distros. solves the problem i think.