This way, you can run OSQueryi with the process, file and socket events (given that audit is configured and available in the kernel), and run queries whenever you wants, without stopping the event collection