I also find that running osqueryd with sudo to not be equivalent to running as root instead