@Mustafa does this issue seem related to what you're experiencing? https://github.com/facebook/osquery/issues/4433