this might be help…Scheduled query failures and the watchdog The osquery watchdog is only used in the daemon. It is enabled by default and can be disabled with --disable_watchdog=true. The watchdog enforces limits on a forked ‘worker’ process to protect systems from CPU expensive and memory-intensive queries. If the watchdog observes limit violations it will emit errors similar to: Scheduled query may have failed: pack_threat_detectors_launch_daemons