@theopolis thanks for those links, i don't think it's one of those, but i'm honestly not too sure. @groob and i are going to make some docker tooling to make containers from osquery source so we can have debug binaries (to get cores) and extra logging to hopefully test some hypotheses