indeed; so circling back to our problem :troll: :
...
# generalc
coffee
03/10/2017, 7:11 PMindeed; so circling back to our problem 🧌 :
Copy code
osquery> select count(*) from syslog;
+----------+
| count(*) |
+----------+
| 1122 |
+----------+
osquery> W0310 18:54:02.142974 15138 events.cpp:282] Expiring events for subscriber: syslog (limit 100000)
select count(*) from syslog;
+----------+
| count(*) |
+----------+
| 1130 |
+----------+