@cburr would you mind adding a comment to https://github.com/facebook/osquery/issues/3984 and include the error message and ulimit output?