@Zander Mackie by the way, another user might have the same issue; I’m briefly having a look at it in #ebpf. If you could report there what osquery version are you using, which distro and kernel. Thanks!

will do.