Sure sure, currently

auditctl -s

never shows the backlog higher than 0, so I don’t think the issue is that the osquery master isn’t pulling events off fast enough, it’s more so that it is pulling off so many events from the audit socket and then trying to parse/write them to RocksDB