A question on https://github.com/facebook/osquery/blob/master/docs/wiki/deployment/process-auditing.md#osquery-events-optimization "--event_expiry -default 86000. Setting this value to 1 will auto-clear events event select, reducing all impact of the buffer." If I'm reading this correctly, once the events are SELECT'd by osqueryd, the buffer is cleared if the value is set to 1. Otherwise, the buffer is cleared once X seconds have elapsed. Questions: (a) is the buffer used by osqueryi, osqueryd, or both? (b) Why: if events_expiry is kept as the default (86000), and a scheduled query runs every 3600 seconds, will it capture duplicate data until the buffer is cleared? (c) What ensures that a buffer clear doesn't impact a scheduled query? If the buffer is cleared every X hours, and the scheduled query runs ~X hours, how does osquery ensure that a positive splay doesn't result in lost data? Thanks 🙂