@stefanmaerz check the read the docs (https://osquery.readthedocs.io/en/stable/installation/cli-flags/) they have a bit more detail, but the short of it is that there's a time element associated as well

I actually started at that page. Didn't see the "utilization" section the first time through, so I went to the command line help. Anyways, I think I understand now: osquery won't do anything the first 9 seconds, then the watchdog will cut in and save the day. So I suppose to get the funcitonality I was thinking of, I would need to take a look at cgroups.