i think the machines should run the scheduled queries which last taken(until they get the new ones) and I tested your second question. As long as the osqueryd service run, the agent fill up the local database and once the connection established it push to fleet. However if i’m not wrong, in this point if windows_events table is used it’s needed to think the events_max and events_expiry flags