@nebi here's a good thread on that issue..tl;dr most likely cause is process is gone but socket still open at query time, since you're not using audit framework https://github.com/facebook/osquery/issues/4173