I've also tried it with and without this osquery.flags: --audit_allow_config=true --audit_allow_sockets --audit_persist=true --disable_audit=false --events_expiry=1 --events_max=500000 --logger_min_status=1 --logger_plugin=filesystem --watchdog_memory_limit=350 --watchdog_utilization_limit=130