Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

We're running into this interesting issue on a single box. We're seeing the following:

```
W1025 16:30:14.128159 23694 events.cpp:304] Expiring events for subscriber: syslog limit (100000) exceeded: 100072
W1025 16:30:21.212126 23709 events.cpp:304] Expiring events for subscriber: syslog limit (100000) exceeded: 100168
....
```

and

```
I1025 16:50:56.663689 27392 rocksdb.cpp:130] RocksDB: [WARN] [queries] Stopping writes because we have 3 immutable memtables (waiting for flush), max_write_buffer_number is set to 3
....
```

we have no data to suggest that we're writing greater than 1000 logs/s to the syslog pipe (aka hitting the max of <https://github.com/facebook/osquery/pull/2526/files>)