@marcin, @groob: Fix PR is up for your issue (https://github.com/facebook/osquery/pull/2328). For a temporary fix, you can use the flag

--buffered_log_max=0

which will turn off the count check.