So — edit to this since this has been up too long to edit in place -- I forgot this is for macOS — the --audit_allow_config=true flag isn’t supported on mac, I believe. I originally was pulling from linux. so, just

sudo osqueryi --disable_events=false --disable_audit=false