For the RocksDB and excessive FDs issue, there was no magic involved. We upgraded the static RocksDB we build for Linux+macOS to the latest, and FreeBSD upgraded their port to use the same, a 5.7.x version. After digging into our usage with RocksDB developers we saw we had been using the API incorrectly in 1 place so we changed that, and 2.8 osquery includes that change. It should not have been causing "lots of FDs" but was not helping. We added some limits to the FD usage for RocksDB but they should have been defaulting to acceptable numbers like 1024 (but it's unclear if macOS is more restrictive than 1024 from my research, it seemed like 256 was the default limit). The last thing we did not add, which would be helpful, is proactive monitoring of the number of open FDs. This could be implemented in the osquery watchdog.