hi there, i am trying to enable evented tables on ...
# macos
n
hi there, i am trying to enable evented tables on my mac, and have been using the following docs as a guide: https://github.com/facebook/osquery/blob/master/docs/wiki/deployment/process-auditing.md#macos-process-auditing and https://github.com/facebook/osquery/blob/master/docs/wiki/deployment/debugging.md#using-event-publishers-and-tables-in-the-shell. i have
--disable_database=false
and
--disable_events=false
flags set, but still when i run the query
select * from process_events;
there is nothing there. does anyone know if i'm missing something?