Hello. I think cleanup_events check https://github.com/osquery/osquery/blob/24bdf7842b548cd6d8ecfc4ea19e0e322af213ef/osquery/events/eventsubscriberplugin.cpp#L182 doesn't make sense. Shouldn't it be like

cleanup_events = ((event_count_ % kEventsCheckpoint + row_list.size()) > kEventsCheckpoint);
    event_count_ += row_list.size();