are you using the tls config plugin? could it have logged in

/tmp

at first run, then switched to

/var/log/osquery

after fetching the config remotely?