I am pretty sure I used events in osqueryi a few times, don't 100% remember if it was on Mac, but I can tell you I usually did it by specifying disable-events=false at the command and not in the config (maybe that helps)