osquery> select count(*) from syslog;
+----------+
| count(*) |
+----------+
| 1122     |
+----------+
osquery> W0310 18:54:02.142974 15138 events.cpp:282] Expiring events for subscriber: syslog (limit 100000)
         select count(*) from syslog;
+----------+
| count(*) |
+----------+
| 1130     |
+----------+