@thor we are trying to perform a comprehensive eps test and in this respect we’ve created an event channel and written a powershell script generating some events into that channel containing some certain data which we define in that script.
We also configured the osquery.flags file of a osquery agent to watch that event channel. We’ve run the script and 10000 events was generated in that channel at total and when we monitored the osquery_results log file on fleet server, we noticed that the last received event was 9949th although the total event number written into that log file was 10000. in this case, we see that osquery doesn’t collect the events in the order of generated although it is able to fetch all the events. what causes osquery behaving like that?is that a normal/expected behaviour for osquery?