Hello @theopolis 😀

"decorators": {
  "load": [
    "SELECT name || ' ' ||+version AS osname from os_version;"
    ],
  "always": [
    "SELECT liu.user, liu.tty, liu.host, liu.time, liu.pid, p.name, p.cmdline FROM logged_in_users liu, processes p WHERE liu.type='user' AND liu.pid = p.pid order by time desc limit 1;"
    ]
},

Unfortunately, it's the same results 😢 Even though it was logged out the machine, it's still appended to previous logged-in username, tty, pid and time in osqueryd.results.log. I've tried testing in CentOS 7.2, CentOS 6.8 and Red Hat Enterprise Server 6.6 with osquery 2.6.0-1. I was wondering, if the ALWAYS query has not data, what's append in osqueryd.results.log? For example, if (results.rows().size() == 0) is it return blank data or previous same data? Thanks in advance!