ok, so evented tables are buffered there instead of the osquery.db dir? (Trying to troubleshoot some high volume windows_events issues)