Sorry for the false hope, should've double checked first

sounds like you aren't able to log them either then. 😞

No; I recall having introduced fixes/changes that would make the WEL logger plugin work again and some discussion about that systemLog function which confused me. Anyway I'm not sure if there's a specific reason why only the logger plugin is privy to the EventLog write access, if not maybe that writing to the EventLog is a bit more complicated than just calling syslog. I think this is something we should try to explore ^^'

@Stefano Bonicatti, thanks. According to @theopolis, there needs to be an IPC in between the watchdog and osquery so that the watchdog can access logger plugins - https://github.com/osquery/osquery/issues/6790 That said, it seems odd to me that the systemLog() call the watchdog does only seems to work on unix based systems. Does that call just fail on windows?

std::stringstream error;
      error << "osqueryd worker (" << child.pid()
            << ") stopping: " << status.getMessage();
      systemLog(error.str());
      LOG(WARNING) << error.str();
      stopChild(child);

Windows doesn't have syslog. There are third party libraries, like syslog-ng that would implement that

I see. I just figured Windows might interpret that c code as log to event logs or something. I dont have a ton of windows exp. 😞