@rtacconi yes, you'll need to setup your syslog daemon such that osquery can pick up the events: http://osquery.readthedocs.io/en/stable/deployment/syslog/