We’ve used go-audit extensively at previous job and I can say that we had to tweak the backlog size a bunch based on different types/classes of boxes. Having it hardcoded makes things difficult if you want to have osquery manage audit (which I think is desirable in general).