This talk covers 10 common problems encountered by users of osquery, and how to solve them:
1. Where did my results go (1)? Running queries as user vs. root.
2. Where did my results go (2)? The effect of table order on JOINs.
3. Dude, where’s my SHA1? Hashing big files with read_max flag.
4. Why does this query work in osqueryd but not osqueryi? JSON escaping and queries.
5. Why isn’t my config respected? CLI flags vs. config options.
6. Why didn’t the query run? Understanding schedule intervals in osquery.
7. Where are my events (1)? Osqueryd and osqueryi independence.
8. Where are my events (2)? Tuning event expiration flags.
9. Where are my events (3)? Checking event publisher status with osquery_events.
10. Why is osquery eating my CPU? Identifying expensive queries.
https://www.dactiv.llc/blog/10-pitfalls-on-the-path-to-osquery-bliss/