@zwass I filed an issue for that behavior and looked into it a bit. https://github.com/facebook/osquery/issues/4402