Hey all, I came across this article https://slack.engineering/syscall-auditing-at-scale-e6a3ca8ac1b8.

Osquery is great. In fact, we use it at Slack. For our production servers, we prefer go-audit because these systems are connected 24/7, which allows us to stream data constantly. With osquery, you are generally receiving a snapshot of the current machine state. If something runs to completion between polling intervals, you might miss it. I think this model works well for laptops and other employee endpoints, but I prefer a stream of data for highly-available machines.

Is this still a valid argument? Can we configure Osquery so that it doesn't miss anything?