I'd start by running osqueryd in the foreground, preferably with a verbose flag, just to be sure its actually trying to run that query every second