Yeah I thought so as well we ve only got 15 `file paths` con

Question

Yeah I thought so as well we ve only got 15 `file paths` configured for watching and none of these appear to be directly related to the activities of `nagios`

jaredl · Answer

So the update on this is that it s not any of the scheduled queries I killed them all and still get the same behavior

jaredl · Answer

We currently have this in our `osquery flags` file

jaredl · Answer

``` audit allow config=true audit allow sockets=true audit persist=true disable audit=false events expiry=1 events max=100000 logger min status=1 logger plugin=syslog watchdog memory limit=350 watchdog utilization limit=100 ```

jaredl · Answer

And the only setting I can change that actually makes the CPU usage drop below 100 is setting ` audit allow sockets=false` and restarting osquery

jaredl · Answer

Or leaving that alone and removing the ` a always exit S connect` kernel audit rule that `osqueryd` sets up

jaredl · Answer

shared this thread with < C0F5EQH28|process auditing> to see if anyone there has ideas as well