So, it’s a lot of

connect

syscalls from nagios. But, there’s no supported way with the current audit implementation to tell osquery to not even process these events and instead it tries to write them all to RocksDB and then blows up this CPU (atleast, that’s my understanding of the current issue)