@marpaia I can only speak for a small test case, but in trying to run process_events at a somewhat decent scale, we found that osquery couldn't handle the volume of process_events generated and eventually watchdog would choke/would choke osquery to death