@OpenPlgx yeah i got to the bottom of it. looks like when the service is stopped there is still a running osquery process which seems to lock the DB. if you manually end that process the service will relaunch successfully.