@czanik if you are using

osqueryi

, the events subsystem is disabled by default. You'll need to use the flag

--disable_events=false

in addition to any other flags you would use with

osqueryd

.