Do you know how much they will buffer? I assume there’s some sort of limit on that?

The

--buffered_log_max

flag dictates that. https://osquery.readthedocs.io/en/stable/installation/cli-flags/

Great, thank you! 🙂

Ah @sundsta beat me to it