you'll need to run

osqueryi

or

osqueryd

as root to read from the

syslog_pipe

unless you've set up permissions differently