We buffer events so that out of order events aren't thrown away, but we never throw away any events away. This means that the buffer just grows over time with events from processes outside the process tree.

A quick and easy garbage collection strategy is to keep a generational timestamp for each buffered PID that's updated whenever a new event for that PID is buffered. There would be a global timestamp that increments every time a new event is received. Once the PID's timestamp reaches a certain age relative to the global timestamp, we purge that PID and its events from the buffer.