@theopolis yes, in 10.12 the osquery ASL table will no longer work correct to reach out the new logging DB apple introduced - read logs in 10.12 is no more file based, it's DB based (

/var/db/diagnostics

,

/var/db/uuidtext

) and you get option to either

log collect

log show

and mainly

log stream

in a terminal session ... also some (debug) output from apps is not directly logged into the new db