@theopolis Thank you, what about this error [root@pentaho-prod-di ~]# osqueryi I1217 043836.415366 9005 events.cpp:825] Event publisher not enabled: audit: Publisher disabled via configuration I1217 043836.415446 9005 events.cpp:825] Event publisher not enabled: syslog: Publisher disabled via configuration