It is possible that one or more of these queries caused the watchdog limit to be exceeded, therefore the unfinished queries are blacklisted from the scheduler for 24 hours. After osquery is restarted, the previously active queries are referenced by osquery to see which ones did not finish normally. Once the watchdog limit is reached, the osquery watchdog respawns the child worker process. So, if a watchdog level is set to 350MB and the agent starts up with an initial worker process footprint of 30MB, the watchdog limit will be triggered at 380MB (350MB limit + 30MB initial memory footprint = 380MB threshold limit).

It only restarts the worker if that difference exceeds the watchdog level set at that time.

The watchdog profiles the memory footprint at startup and subtracts that from the monitored value. Memory: When 350MB is reached ( AlienVault Agent default setting).CPU: Above 25% usage for over 9 consecutive seconds.The max threshold settings for the watchdog resources are: The initial watchdog process manages the child worker and terminates any processes that exceed the memory limitations configured in the watchdog settings. The AlienVault Agent is configured to have two osquery processes running: an initial osquery process that functions as a watchdog, and the child worker process that creates the scheduled queries. USM Anywhere™ AlienVault Agents Memory Consumption and the osquery Watchdog

Osquery watchdog