@theopolis 10k table is a rare case for few servers in my company. Some property was using headless user to do some kind automatic operation on few servers for a while, and it left too many login records in the "last" table. After we enabled the verbose mode, we found osquery stops running when it run "select * from last".