It looks like

osqueryd

starts writing logs to

/tmp

before it processes the logger-related config flags.