but

--events_expiry

applies to all event pubsub tables per the documentation?: https://osquery.readthedocs.io/en/1.4.5/installation/cli-flags/ ; and the

syslog

table is a pubsub table right?