@Loqpa yes, the table does not report fork/vfork/clone events by design. I don't really see issues in adding an option to enable them, but I would keep it disabled by default

ok, no problem:)

Here's the PR implementing your feature request 🙂 https://github.com/osquery/osquery/pull/5701

Thank you so much!