@monkykap its all the same thing, the only difference is that instead of logging everything 4 times, osquery logs it once and then does diffs