Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hello, I've got a bunch of osqueryd running at 100% CPU, what can I do to find out why?

I tried the steps given by clong in this issue: <https://github.com/facebook/osquery/issues/5234>, but the resulting numbers didn't indicate any overflow of events or anything, nor was there any messages such as `(overflowed limit 5000)`. restarted the service and they all settled down

if linux, did you try to enforce cgroups?

no I haven't done that yet, any docs that would explain that approach you would recommend?

Not really. <https://github.com/juju4/ansible-osquery/blob/master/tasks/cgroups.yml>