@clippy You'd definitely want to profile any query that you set for "always". osquery never shells out, so many queries are very lightweight.