Our experience has been that the osquery side is "lossier" by a long shot. Not really a criticism of osquery, but especially when it's running on 1000's of endpoints, it's not exactly a stable environment - the number of times we have seen laptops reimaged (whoops, your rocksdb database suddenly looks very different :-)), or the number of PhD's that go "what's this? rm *..."...