yes good question. on osquery agents if you use --logger_plugin=filesystem in osquery.flags file, your results are written to your local. (may be both osquery local db and local osquery_result log file ) if you use --logger_plugin=tls (also in addition you use --logger_tls_endpoint=/api/v1/osquery/log ) your query results are written firstly local db and then pushed to TLS server ( --logger_tls_period=xx)