I probably won't be able to drag it over the finish line, since it's a big change set, but if someone else wants to grab the ball, here's the port of the new events persistence: https://github.com/packetzero/osquery/tree/tp_conveyor