interesting, I think the issue was that osquery itself wasn't generating logs, it was connecting to fleet, enrolling and then freezing/doing nothing. When I changed the logging from TLS to filesystem, no logs were being wrote to disk so from that I conclude that most likely osquery was not generating logs, thus I was not seeing them in status