I'm encountering the same error as @Stephen Touset using osquery version 3.2.6 on Linux. On CentOS 7.4 and uBuntu 16.04 hosts (newly created vagrant VMs), I see logs showing up in /tmp. Config options:

"options": {
        "disable_audit": false,
        "audit_allow_config": true,
        "audit_persist": true,
        "disable_events": "false",
        "logger_plugin": "syslog",
        "config_plugin": "filesystem",
        "logger_syslog_prepend_cee": true,

Flags:

--config_refresh=300
--config_accelerated_refresh=600
--logger_path=/var/log/osquery/

Searching through the osquery repo, it appears that "GOOGLE_LOG_DIR" is not passed to glog when osquery initially starts.