I was just doing some testing in my 4.9.0 to 5.0.1 upgrade on macOS, and noticed that /usr/local/bin/osqueryd was left in place with the version 4.9.0 binary.

/usr/local/bin # ls -lah osq*                                                                                                                                                                12:29:07
lrwxr-xr-x  1 root  wheel    58B Sep 23 12:28 osqueryctl -> /opt/osquery/lib/osquery.app/Contents/Resources/osqueryctl
-rwxr-xr-x  1 root  wheel    38M Jun 22 15:04 osqueryd
lrwxr-xr-x  1 root  wheel    52B Sep 23 12:28 osqueryi -> /opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd

/usr/local/bin # ./osqueryd --version                                                                                                                                                        osqueryd version 4.9.0
/usr/local/bin # /opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd --version                                                                                                              osqueryd version 5.0.1

Shouldn’t that osqueryd be symlinked to /opt/osquery/lib/osquery.app/Contents/MacOS/osqueryd, and not be the version 4.9.0 osqueryd?