Got it, but there are those limits at least both time based and size based which is cool. Clarification question regarding the later, is this read_buffer’s 4096 size; a number of messages (actual lines), or number of audit events? I heard multi-line events from audit might exist too?