it shouldn’t conflict as long as you’re running them with different database paths. https://osquery.slack.com/archives/C08VA8R6F/p1533402168000064 you don’t need the kext for anything anymore, it’s no longer in the repo. the process auditing facilities of the kernel extension were replaced by the process event publisher on macOS which was built using OpenBSM. https://osquery.slack.com/archives/C08VA8R6F/p1533402893000083