i'm trying test with some user open some process but in log of osquery tell me that user "System" or "Local service" .... open it