<https://osquery.readthedocs.io/en/stable/developm...
# core
s
https://osquery.readthedocs.io/en/stable/development/pubsub-framework/ describes it as:
When scheduling queries that include _events (subscriber-based) tables, additional optimizations are invoked. These optimization can be disabled using --events_optimize=false. The subscriber tables can detect they are responding to a schedule and may keep track of the last time the scheduled query has executed. This allows each subscriber to return the exact window of the schedule and delete buffered events immediately. This saves the most memory and disk usage possible while still allowing flexible scheduling.
So with optimize, it will attempt to only deliver things once