So

osqueryd

3.1.0 seems to completely ignore

--logger_path

and

--logger_plugin

and always writes files to

/tmp/osqueryd.${HOSTNAME}.${USERNAME}.log.INFO.${TIMESTAMP}.${PID}

.