right now it’s really up to you, osquery doesn’t really provide any libraries or patterns on how extensions should maintain a buffer of logs if necessary