Hello everyone, I'm following up on a previous question I asked. We are trying to make sure that when we see queries being denylisted that we have the information about why - i.e. did the watchdog trip because of RAM or CPU usage. It turns out that the watchdog isn't able to use logger plugins and that's called out in comments in the code: https://github.com/osquery/osquery/blob/b04da26b9e2819e270ed284f9667c3edb719bf1e/osquery/core/watcher.cpp#L354

// Since the watchdog cannot use the logger plugin the error message
 // should be logged to stderr and to the system log.

https://github.com/osquery/osquery/blob/b04da26b9e2819e270ed284f9667c3edb719bf1e/osquery/core/watcher.cpp#L527-L537

if (exceededCyclesLimit(change)) {
    return Status(1,
                  "Maximum sustainable CPU utilization limit exceeded: " +
                      std::to_string(change.sustained_latency * change.iv));
  }

  // Check if the private memory exceeds a memory limit.
  if (exceededMemoryLimit(change)) {
    return Status(
        1, "Memory limits exceeded: " + std::to_string(change.footprint));

On Mac and Linux, these are logged to various system log files (i.e. /var/log/system.log, /var/log/messages), but on Windows we are not able to file anything logged. We originally theorized that perhaps enabling the windows_event_log logger plugin would get these written to the event logs, but that actually seems unlikely based on those comments above. Does anyone here have experience with this and know if these messages are logged on Windows clients, and if so, where? P.S. we are managing all clients with Fleet, using only the tls logger plugin, and controlling all client config in osquery.flags.