5 log locations · macOS, Linux
osquery logs to /var/log/osquery/osqueryd.results.log on macOS. 2 other macOS log locations are recorded below.
osquery logs to /var/log/osquery/osqueryd.results.log on Linux. 1 other Linux log location is recorded below.
Paths are printed exactly as osquery writes them. Environment variables like %LOCALAPPDATA% and $XDG_STATE_HOME are never expanded, so a path can be pasted straight into a shell. Where a path differs between installer types or shipping flavours, each one is racked as its own card below - why that happens.
/var/log/osquery/osqueryd.results.log/var/log/osquery/osqueryd.snapshots.log/var/log/osquery/- osqueryd.INFO, .WARNING and .ERROR/var/log/osquery/osqueryd.results.log/var/log/osquery/osqueryd.INFO- Symlink to the latest; WARNING, ERROR and FATAL alongside.