Hi, I have a question about how the

--events_optimize

parameter works; it is enabled by default. I currently have

--watchdog_level=0

in my osquery configuration, and

--events_optimize

is set to false. I collect data from the *_events tables and I’m concerned that I might run into issues with losing some logs. According to the documentation, this parameter works as follows:

Every time the SELECT query runs on a subscriber, the current time is saved. Subsequent SELECTs will use the previously saved time as the lower bound.

I’m interested in how the current time is saved: is it recorded after the query completes successfully, or before the query completes, at execution time? Just in case a query against a *_events table becomes resource-intensive, the watchdog may kill the osquery process, and if the current time is saved at execution time, I could lose logs, since the next query will no longer see older events.