Hi guys, long time lurker here, sorry if this channel is not the best one but I have some code questions and I think it’s fitting. I’m trying to better understand the behavior of the pub/sub framework as it reads audit events. I have some questions: 1) I’ve read in docs that there is a 1 second delay between an event taking place and osquery’s pub/sub framework picking it up — is this the line that’s responsible for this: https://github.com/osquery/osquery/blob/master/osquery/events/linux/auditdnetlink.cpp#L127 ? This is the getEvents() function that is called by the publisher: https://github.com/osquery/osquery/blob/e6fe15eb49660725e65dba1549932ed96e0a8c6e/osquery/events/linux/auditeventpublisher.cpp#L85 — Also, wording this in another way, is it fair to say that osquery is reading from the netlink socket every 1 second? 2) The AuditdNetlinkReader creates an std::vector read_buffer with a size of 4096: https://github.com/osquery/osquery/blob/master/osquery/events/linux/auditdnetlink.cpp#L140 and then this size is actually used in the acquireMessages() function here: https://github.com/osquery/osquery/blob/master/osquery/events/linux/auditdnetlink.cpp#L217 to limit the number of events osquery will read from the socket. My initial impression seeing this was that osquery reads up to 4096 events every 1 second (assuming what I said above in 1) is correct). But I’m not sure if this is actually the case as the function is called by the AuditdNetlinkReader’s start() function in a while loop: https://github.com/osquery/osquery/blob/master/osquery/events/linux/auditdnetlink.cpp#L185 which breaks if $interrupted = True (which I suppose happens based on a signal but I don’t know what this signal is) — Can somebody explain the significance of the size (4096) of this read_buffer variable? Is the statement “osquery reads up to 4096 events every 1 second” right or wrong?