TL;DR - a bunch of our hosts have (i think?) low values set for maxfiles in ulimit. You can create a plist to persistently change those settings: https://github.com/facebook/osquery/issues/3984#issuecomment-351530096