@cburr @zwass Thanks. After a bit of debugging and seeing that everything is correctly configured on the osquery side I gave a try to rsyslog. It turned out, that the syslog-ng template produced a slightly different output (a space after commas in the CSV) what osquery did not like. I changed the template and now it works fine