@jtm it is enabled by default in

osqueryd

and disabled by default in

osqueryi

. Some event-based tables need explicit configuration.