Hi @crovers, yes, if the epoch changes, it'll dump all of them as adds again. Epoch was designed for systems that try to re-create the full state of the machine on a SIEM like backend - so, for example, if you wanted to answer "tell me all the users that were logged in at 2:13 PM last Tuesday", having the full state of the machine at that time would make it very useful to answer that question.