is eventing enabled? rocksdb uses more memory than osqueryi with the ephemeral (i.e. std::map) database plugin

Sorry, but were you commenting on my post. (I'm new to slack). If yes. All the settings were the same and all events enabled. We pretty much cloned the machines and them replace the osquery in one of them. As you said it is hard to know without real look into. I will probably be looking into it and will keep people up-to-date.