I’m 90% sure it’s solely the volume of audit event...
# general
j
I’m 90% sure it’s solely the volume of audit events that OSQuery can’t handle