@kidcartouche did you see output similar to:

osquery> .all socket_events
W1124 11:47:54.432190  2758 virtual_table.cpp:492] Table socket_events is event-based but events are disabled
W1124 11:47:54.432289  2758 virtual_table.cpp:499] Please see the table documentation: <https://osquery.io/docs/#socket_events>

Is this Linux or OS X you're testing on? @zwass's note will get you past that:

osqueryi --verbose --nodisable_events
I1124 11:50:15.193758  2897 init.cpp:364] osquery initialized [version=2.1.2-48-gcd0cfbc]
I1124 11:50:15.193850  2897 extensions.cpp:275] Could not autoload extensions: Failed reading: /etc/osquery/extensions.load
I1124 11:50:15.193898  2897 extensions.cpp:288] Could not autoload modules: Failed reading: /etc/osquery/modules.load
I1124 11:50:15.194141  2899 interface.cpp:307] Extension manager service starting: /home/reed/.osquery/shell.em
I1124 11:50:15.194195  2897 init.cpp:606] Error reading config: config file does not exist: /etc/osquery/osquery.conf
I1124 11:50:15.194259  2897 events.cpp:690] Event publisher failed setup: audit: Publisher disabled via configuration
I1124 11:50:15.194326  2897 events.cpp:690] Event publisher failed setup: kernel: Cannot access /dev/osquery
I1124 11:50:15.194355  2897 events.cpp:690] Event publisher failed setup: syslog: Publisher disabled via configuration
I1124 11:50:15.194667  2897 events.cpp:909] Error registering subscriber: socket_events: Subscriber disabled via configuration
I1124 11:50:15.195118  2900 events.cpp:620] Starting event publisher run loop: inotify
I1124 11:50:15.195240  2901 events.cpp:620] Starting event publisher run loop: udev
Using a virtual database. Need help, type '.help'
osquery>

Check out http://osquery.readthedocs.io/en/stable/deployment/process-auditing/ it should get you the rest of the way. 😄