Hello! So in osquery version < 5.0.1 the watchdog was not taking into account the private bytes (so live memory + paged out), but only the live one, so that’s the reason for the difference.
Now for the increased usage in memory, it highly depends on how many events osquery is handling.
One way to see if the memory increase seems to stop at a certain point or not is to actually disable the watchdog
--disable_watchdog=true
, or you can progressively increase the memory limit with
--watchdog_memory_utilization=<MB>