@mdunten yeah, for sure. osqueryi is just good for exploratory. for centos, things can get tricky because often auditd is also installed