I've just installed osquery for the first time, on ubuntu xenial, and I get several "failed setup" messages in the log on startup. For example: severity=0 location=events.cpp:649 message=Event publisher failed setup: kernel: Cannot access /dev/osquery There is no /dev/osquery. There are also messages about "audit: Publisher disabled via configuration" and "syslog: Publisher disabled via configuration" - which is weird because messages are clearly going to syslog. I also haven't explicitly disabled anything AFAIK.