alessandro@rpi3:~$ sudo dpkg -i arm_packages_pr_6612/osquery_4.4.0-82-gd8170072-1.linux_arm64.deb
Selecting previously unselected package osquery.
(Reading database ... 206065 files and directories currently installed.)
Preparing to unpack .../osquery_4.4.0-82-gd8170072-1.linux_arm64.deb ...
Unpacking osquery (4.4.0-82-gd8170072-1.linux) ...
Setting up osquery (4.4.0-82-gd8170072-1.linux) ...
1145
Processing triggers for systemd (245.4-4ubuntu3.2) ..
alessandro@rpi3:~$ sudo osqueryi 'SELECT hostname, cpu_type FROM system_info;'
+----------+----------+
| hostname | cpu_type |
+----------+----------+
| rpi3     | aarch64  |
+----------+----------+
alessandro@rpi3:~$ sudo osqueryi 'SELECT COUNT(*) FROM processes;'
+----------+
| COUNT(*) |
+----------+
| 193      |
+----------+
alessandro@rpi3:~$ sudo osqueryi --verbose --disable_events=false --disable_audit=false --audit_allow_config=true --audit_allow_process_events
I0905 09:07:30.897889  3348 init.cpp:340] osquery initialized [version=4.4.0-82-gd8170072]
I0905 09:07:30.898211  3348 extensions.cpp:453] Could not autoload extensions: Cannot open file for reading: /etc/osquery/extensions.load
I0905 09:07:30.898931  3348 dispatcher.cpp:78] Adding new service: ExtensionWatcher (0xaaaaf3d68f68) to thread: 281473261716496 (0xaaaaf3d5e6e0) in process 3348
I0905 09:07:30.899204  3348 dispatcher.cpp:78] Adding new service: ExtensionRunnerCore (0xaaaaf3d67c28) to thread: 281473253323792 (0xaaaaf3d67e50) in process 3348
I0905 09:07:30.899415  3348 auto_constructed_tables.cpp:97] Removing stale ATC entries
I0905 09:07:30.899415  3350 interface.cpp:270] Extension manager service starting: /root/.osquery/shell.em
I0905 09:07:30.904469  3348 init.cpp:601] Error reading config: config file does not exist: /etc/osquery/osquery.conf
I0905 09:07:30.904908  3348 events.cpp:867] Event publisher not enabled: syslog: Publisher disabled via configuration
I0905 09:07:30.905474  3348 events.cpp:1126] Error registering subscriber: apparmor_events: Subscriber disabled via configuration
I0905 09:07:30.905805  3348 events.cpp:1126] Error registering subscriber: process_file_events: Subscriber disabled via configuration
I0905 09:07:30.905942  3348 events.cpp:1126] Error registering subscriber: selinux_events: Subscriber disabled via configuration
I0905 09:07:30.906055  3348 events.cpp:1126] Error registering subscriber: socket_events: Subscriber disabled via configuration
I0905 09:07:30.983044  3348 dispatcher.cpp:78] Adding new service: AuditdNetlinkReader (0xaaaaf3d65a58) to thread: 281473244787728 (0xaaaaf3d6ae40) in process 3348
I0905 09:07:30.983456  3348 dispatcher.cpp:78] Adding new service: AuditdNetlinkParser (0xaaaaf3d6b018) to thread: 281473127826448 (0xaaaaf3d6b0c0) in process 3348
I0905 09:07:30.983992  3354 events.cpp:786] Starting event publisher run loop: auditeventpublisher
I0905 09:07:30.984421  3351 auditdnetlink.cpp:329] Attempting to configure the audit service
I0905 09:07:30.984639  3356 events.cpp:786] Starting event publisher run loop: inotify
I0905 09:07:30.985014  3351 auditdnetlink.cpp:357] Enabling audit rules for the process_events (execve, execveat) table
I0905 09:07:30.985420  3357 events.cpp:786] Starting event publisher run loop: udev
Using a virtual database. Need help, type '.help'
osquery> SELECT * FROM process_events;
+------+---------------+---------+----------------------+--------------------+------+------+------+------+------+-----------+-----------+------------+------------+------------+-------+--------+------------+--------+-------+------+-------+------+---------+
| pid  | path          | mode    | cmdline              | cwd                | auid | uid  | euid | gid  | egid | owner_uid | owner_gid | atime      | mtime      | ctime      | btime | parent | time       | uptime | fsuid | suid | fsgid | sgid | syscall |
+------+---------------+---------+----------------------+--------------------+------+------+------+------+------+-----------+-----------+------------+------------+------------+-------+--------+------------+--------+-------+------+-------+------+---------+
| 3358 | /usr/bin/date | 0100755 | date                 | "/home/alessandro" | 1000 | 1000 | 1000 | 1000 | 1000 | 0         | 0         | 1599286374 | 1567679920 | 1597234753 | 0     | 1788   | 1599289658 | 877    | 1000  | 1000 | 1000  | 1000 | execve  |
| 3359 | /usr/bin/sudo | 0104755 | sudo nano /etc/hosts | "/home/alessandro" | 1000 | 1000 | 0    | 1000 | 1000 | 0         | 0         | 1599287362 | 1594772278 | 1597234753 | 0     | 1788   | 1599289663 | 882    | 0     | 0    | 1000  | 1000 | execve  |
| 3360 | /usr/bin/nano | 0100755 | nano /etc/hosts      | "/home/alessandro" | 1000 | 0    | 0    | 0    | 0    | 0         | 0         | 1599289634 | 1586527950 | 1597234753 | 0     | 3359   | 1599289663 | 882    | 0     | 0    | 0     | 0    | execve  |
+------+---------------+---------+----------------------+--------------------+------+------+------+------+------+-----------+-----------+------------+------------+------------+-------+--------+------------+--------+-------+------+-------+------+---------+