@groob - Anything specific you think I’m looking for? All of our hosts get the same

/etc/osquery/osquery.conf

file, only hosts that run Nagios (so far) are seeing this behaviour.