Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

(this is v4.1.2…I’ll try with the latest 4.2.0)

it seems that the problem was using --`flagfile="c:\program files\osquery\osquery.pid"` with the double quotes. Without the double quotes it works:
`flagfile=c:\program files\osquery\osquery.pid`

You’re also pointing the flag file to a PID file, which may cause issues

sorry, I mistyped, I meant pidfile! :slightly_smiling_face: ..and also happened to other parameters that get a file path like database_path, enroll_secret_path, etc.

This is actually documented in installation/cli-flags/#flagfile :sweat_smile:

&gt; NOTICE: Flags in a `flagfile` should not be wrapped in quotes, shell-macro/variable expansion is not applied!
