henry are you getting results manually at the CLI that you don't see in osquery, or conversely in the GUI?