@theopolis: I believe I found a pretty serious bug in the behavior of the

--events_optimize

flag (which is enabled by default): https://github.com/facebook/osquery/issues/2656