osqueryd has a log path flag you can override