Just to be sure, previously you said you set `even...
# general
s
Just to be sure, previously you said you set
events_max=1
and
buffered_log_max=1
, can you confirm again that
events_expiry
is at 1 or a low value where you would expect the query to expire the events?
j
now i have
events_max=1
 and 
buffered_log_max=1
and events_expiry=10
s
Ok! I would say that this looks like a bug. Could you open an issue with all the configs you have given so that we can reproduce it and have a better look at it? Thanks!
j
sure thing
Hey @Stefano Bonicatti, i have created https://github.com/osquery/osquery/issues/7079 let me know if you need any other info