@jankins: Those tables require being explicitly enabled. For syslog check out https://osquery.readthedocs.io/en/latest/deployment/syslog/#linux-syslog