Yeah that should help, in the osqueryi she’ll can you check the value of the flag? Select * from osquery_flags where name = ‘read_max’?