and.. another problem is that.. Engine state is changed from None to available etc. head information isn’t written to the logs. Osqueryd only collecting the contents which in Details (the contents appears by clicking the Details… in event viewer)