@James McPhee why is it dead? we're collecting all shell commands from all user + all process events across our entire fleet and it seems to be working fine. Curious what your pain points are?