you wrote previously… also those are for distributed queries… also as a note distributed query results aren’t written to osquery_result log file that’s also API endpoint not a path and you can set the path when you start the fleet TLS server .. /usr/bin/fleet serve --mysql_address=…… --mysql_database=…. ……… osquery_result_log_file=path/to/logfile --osquery_status_log_file=path/to/logfile