but no osquery logs in system.log