Hi, any idea?

I'm guessing you are in

osqueryi

? You need

--disable_events=false

.

I think along with disable_events, you also need to enable event publishers via flags