@Anadi Our watchdog level was 0. We were using osqueryi in a screen session, not osqueryd - in case that makes a difference. Is osqueryd (where the problem manifested itself) watched by the watchdog or the extension?