@cburr we ran into the exact same problem and it turned out to be this: https://github.com/facebook/osquery/issues/3984