hello, all and @theopolis . After installing and starting osquery on Ubuntu 16.04, there's this error message that said it "kernel publisher cannot access /dev/osquery". Further investigation indicated that /dev/osquery does not exists. Now I know that creating it manually is not a good thing, so what's the solution. By the way, even after creating it manually, this other error message was generated: "Event publisher failed setup: kernel: Could not allocate shared buffer"