@sean.cavanaugh i probably will not be able to provide much help as this is in regards to the since-deprecated kolide fleet project, but out of curiosity are you running osqueryi with sudo?

will move to the other channel, but no I’m not running osqueryi w/ root

results will differ based on whether osquery is run as root/sudo, since fleet by default runs queries as root, you will need to run osqueryi with sudo to appropriately compare the output of the two.