Probably a dumb question, but I see this when watchdog kicks on

osqueryd: osqueryd worker (10022) stopping: Maximum sustainable CPU utilization limit exceeded: 12

it looks like osquery just diffs user_time and system_time to get that info, but my question is the

12

is that a time, like seconds, or milliseconds? if so, what is the metric?

That’s the amount of seconds that the CPU used by osquery exceeded the limit set in usage.

ok so it's in seconds, and is more or less a 1:1 ratio of time/cpu usage?

Sorry I’m not sure if I understood, but basically the watchdog has an interval where it checks for the CPU usage of the worker. Each time the CPU usage is > than the limit set via the

watchdog_utilization_limit

flag, it increases an internal counter, or resets it if the CPU usage is below the limit. That counter is then used to calculate that final number you see, using the configured check interval.

ah I see, thanks!