Since most jobs just write one event, I think the effect of caching would be negligible. When jobs write a lot of events, then they should be writing them to different files. (I will check on the PID assignment and virus scan events.)