Cool, yeah, we’re already collecting the

osquery_schedule

thankfully, looking at

wall_time

over the last 24 hours, looks like

file_events

is the worst offender here.