i was looking at results of the

osquery_events

table and noticed that i get results for

_events

that we don't query for. the only one we have is for

file_events

, but for example

udev

and

hardware_events

both have 1 subscription with >0 events.