@barn are you on latest osquery release? I recall this being an issue a couple versions ago, and @theopolis had made some changes to ensure we weren't opening as many handles, I believe