sorry for the delay i had to go digging on terminal buffer since i had to shut it down (batteries): the parent per ps auxf was process 21720 "/usr/bin/osqueryd --flagfile /etc/osquery/osquery.flags --config_path /etc/osquery/osquery.conf"