mmm ok, so maybe I've tried on 19.10. At least I know that on recent kernels they've changed a system header which is used by libaudit and defines something that libaudit was previously defining

I've hit the same problem as well. It happened because osquery hosts an old version of libaudit that is not compatible with the newest linux kernel headers. I solved it by using system

libaudit

library. It is the task@alessandrogario and @theopolis work on.