hey @Graham Anderson posting the question here https://osquery.slack.com/archives/C08V7KTJB/p1670408244539229

Solved: o I can see in orbit with $ORBIT_DEBUG=true that the upstream POST request times out, and some additional error messages in the server logs indicate error getting app config as well. Some searching of the github issues suggest this is due to an under provisioned mysql instance. I've re-deployed the cloud db with more resources and software packages are now listed under the hosts... As for the first issue, I think the interface query was being "denylisted" because the osquery daemon was restarting due to memory limits - because of failed post requests

Glad you were able to figure this out. This is likely due to the osquery watchdog. More information can be found in https://fleetdm.com/guides/osquery-evented-tables-overview#performance-impact You can confirm which queries are being denylisted by running the following query

SELECT name, query FROM osquery_schedule WHERE denylisted='1'

Let me know if you need any further help.