Hi, a couple of questions, grateful for any advice, is it generally considered good practice to limit scheduled queries to return results only for the period since the last time the query ran? And if a Linux server had auditd running previously, then osquery is installed and file/process/socket auditing is enabled, and auditdctl -s is enabled and the pid of osqueryd, I've seen multiple times where I've had to reboot the server before process and socket auditing would produce any results. is there something other than stopping the auditd process that is needed to get it working without a reboot?