@coffee you should be seeing logging if the events are expired because the max was exceeded: https://github.com/facebook/osquery/blob/master/osquery/events/events.cpp#L281-L285