With the osqueryi shell add --nodisable_events and...
# general
t
With the osqueryi shell add --nodisable_events and run as root to test