Oddly enough I wasn't seeing anything in the syslog table (select * from syslog) after having done: sudo osqueryi --enable_syslog --disable_events=false --verbose --syslog_pipe_path=/<snip