is there a good general way to think about the difference in capabilities between using osqueryi and connecting to the em socket?