typically I would also recommend setting

--disable_audit true

so that osquery tries to gain control of the audit socket