@the_drow @clong is correct, the shell is just a shell, it doesn't log anything. More details + syslog logging: http://osquery.readthedocs.io/en/stable/deployment/logging/