Event publishers incorrectly Active or not, in osquery_registry and osquery_events

Bug report

To verify the active status of event publishers, it seems you are intended to be able to query osquery_registry, but it only ever shows 1 (active) for every publisher, which I believe is incorrect. The correct values show in osquery_events.

What operating system and version are you using?

version = 10.0.18363
build = 18363
platform = windows

What version of osquery are you using?

version = 4.5.1-32-g2da28bb18

What steps did you take to reproduce the issue?

First I looked at the osquery_events table.

osqueryi.exe --disable_events=false --enable_powershell_events_subscriber
osquery> select * from osquery_events;
+--------------------------+--------------------------+------------+---------------+--------+-----------+--------+
| name                     | publisher                | type       | subscriptions | events | refreshes | active |
+--------------------------+--------------------------+------------+---------------+--------+-----------+--------+
| WindowsEventLogPublisher | WindowsEventLogPublisher | publisher  | 0             | 0      | 0         | 1      |
| ntfs_event_publisher     | ntfs_event_publisher     | publisher  | 0             | 0      | 0         | 0      |
| ntfs_journal_events      | ntfs_event_publisher     | subscriber | 0             | 0      | 0         | 1      |
| powershell_events        | WindowsEventLogPublisher | subscriber | 0             | 0      | 0         | 0      |
| windows_events           | WindowsEventLogPublisher | subscriber | 0             | 0      | 0         | 0      |
+--------------------------+--------------------------+------------+---------------+--------+-----------+--------+

What did you expect to see?

• I expected it to show 1 for Powershell events, but maybe it still shows 0 because it's still inactive because of the required setting to log Powershell scripts. Okay. Misleading but it could be documented.
• I did not expect to see the WindowsEventLogPublisher as active, since the flag --enable_windows_event_publisher was not set, and this is confirmed by querying the osquery_flags table.
• I expected consistency with the osquery_events table at least, but correctness would be better.

osquery> select * from osquery_registry where registry like "event%";
+------------------+--------------------------+------------+----------+--------+
| registry         | name                     | owner_uuid | internal | active |
+------------------+--------------------------+------------+----------+--------+
| event_publisher  | WindowsEventLogPublisher | 0          | 0        | 0      |
| event_publisher  | ntfs_event_publisher     | 0          | 0        | 0      |
| event_subscriber | ntfs_journal_events      | 0          | 0        | 0      |
| event_subscriber | powershell_events        | 0          | 0        | 1      |
| event_subscriber | windows_events           | 0          | 0        | 0      |
+------------------+--------------------------+------------+----------+--------+

☝🏻 this is what I expected to see (this is not what I see)

What did you see instead?

osquery> select * from osquery_registry where registry like "event%";
+------------------+--------------------------+------------+----------+--------+
| registry         | name                     | owner_uuid | internal | active |
+------------------+--------------------------+------------+----------+--------+
| event_publisher  | WindowsEventLogPublisher | 0          | 0        | 1      |
| event_publisher  | ntfs_event_publisher     | 0          | 0        | 1      |
| event_subscriber | ntfs_journal_events      | 0          | 0        | 1      |
| event_subscriber | powershell_events        | 0          | 0        | 1      |
| event_subscriber | windows_events           | 0          | 0        | 1      |
+------------------+--------------------------+------------+----------+--------+
osquery> select * from osquery_flags where name like "%event%";
+-------------------------------------+--------+-----------------------------------------------------+-----------------------------------+-----------------------------------+------------+
| name                                | type   | description                                         | default_value                     | value                             | shell_only |
+-------------------------------------+--------+-----------------------------------------------------+-----------------------------------+-----------------------------------+------------+
| disable_events                      | bool   | Disable osquery publish/subscribe system            | false                             | false                             | 0          |
| enable_ntfs_event_publisher         | bool   | Enables the NTFS event publisher                    | false                             | false                             | 0          |
| enable_powershell_events_subscriber | bool   | Enables Powershell events                           | false                             | true                              | 0          |
| enable_windows_events_publisher     | bool   | Enables the Windows events publisher                | false                             | false                             | 0          |
| enable_windows_events_subscriber    | bool   | Enables Windows Event Log events                    | false                             | false                             | 0          |
| events_expiry                       | uint64 | Timeout to expire event subscriber results          | 3600                              | 3600                              | 0          |
| events_max                          | uint64 | Maximum number of events per type to buffer         | 50000                             | 50000                             | 0          |
| events_optimize                     | bool   | Optimize subscriber select queries (scheduler only) | true                              | true                              | 0          |
| logger_event_type                   | bool   | Log scheduled results as events                     | true                              | true                              | 0          |
| logger_snapshot_event_type          | bool   | Log scheduled snapshot results as events            | false                             | false                             | 0          |
| ntfs_event_publisher_debug          | bool   | Debug the NTFS event publisher                      | false                             | false                             | 0          |
| windows_event_channels              | string | Comma-separated list of Windows event log channels  | System,Application,Setup,Security | System,Application,Setup,Security | 0          |
+-------------------------------------+--------+-----------------------------------------------------+-----------------------------------+-----------------------------------+------------+

In summary, I see a few problems:

1. enable_windows_events_publisher appears to be false (the default), but the publisher shows as 1 in the active column in osquery_events.
2. enable_powershell_events_subscriber is true but the subscriber is 0 in the active column of osquery_events.
3. it looks like osquery_registry is incorrectly showing all event publishers to be active.

Start by reproducing the Windows behavior with the provided osqueryi commands, then compare the active values reported by osquery_registry and osquery_events for event publishers and subscribers. Trace how those tables determine active status and use the listed event flags to check the expected states. Done means the registry and events tables consistently report whether each event component is active.