Even if osquery chunked logs like nginx that'd be good enough. My observations on windows are if I delete the results log, osqueryd then doesn't build a new one, it just fails to write to the now non-existant log file until I restart it. Seems not ideal to have to stop osqueryd, delete the overly large log and then start osqueryd again. Be good if it could log into chunks and we can just cleanup the cold chunks leave the hot chunk that it's still writing to.