Hello everyone, I'm testing the BPF event tables with OSQuery. When I enable this feature, I get about a 2% increase on CPU load, even without running any scheduled queries. Is that normal? Here's my settings:

$ osqueryd --version
osqueryd version 5.12.1-1-g399bc1059-dirty

$ cat osquery.flags
--disable_events=false
--events_expiry=1
--events_max=500000
--logger_min_status=1
--logger_plugin=filesystem
--watchdog_memory_limit=350
--watchdog_utilization_limit=130
--enable_bpf_events=true

$ cat osquery.conf
{
  	"platform": "linux"
}

~cat /etc/lsb-release 
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=18.04
DISTRIB_CODENAME=bionic
DISTRIB_DESCRIPTION="Ubuntu 18.04.6 LTS"

I get a lot of errors like the following on the

osqueryd

daemon's output, not sure if it's related:

I0205 21:09:22.036317 30104 bpferrorstate.cpp:73] Failed to process one or more events from the following tracers: 186
I0205 21:09:28.037880 30104 bpferrorstate.cpp:55] Buffers/strings that could not be captured by the probe: 3
I0205 21:09:34.039438 30104 bpferrorstate.cpp:55] Buffers/strings that could not be captured by the probe: 4
I0205 21:09:40.040957 30104 bpferrorstate.cpp:55] Buffers/strings that could not be captured by the probe: 6
I0205 21:09:46.016978 30104 bpferrorstate.cpp:55] Buffers/strings that could not be captured by the probe: 9