could also be the syslog hang bug (fix: https://github.com/facebook/osquery/pull/5259)

Thank you, going to try this. PR has been open for a while, any reason why it hasn’t merged?

They stopped doing any merges into 3.3.x several months ago. All PRs need to be rebased to experimental. The osql fork is likely the way forward for fixes.