the additional information that would be needed to answer with certainty are, imo: - what is the exact time that osqueryd starts the first time - how long does it run before watchdog kills it - was the computer asleep for any time during that period - what is the exact time that osqueryd started the second time