I may have determined that this is linked to his bash history (
Jun 22 12:35:33 xxxxxxx osqueryd: osqueryd worker (82507) stopping: Memory limits exceeded: 222240768
) because when we move it somewhere else and create a new one, the log doesn’t appear again. His history is 4.5MB, I don’t know if it’s too big (guess not but saying it just in case). Any thing we try to do to find the root cause without deleting his all history ?
SELECT * from users JOIN shell_history using (uid);