To clarify this question, I verified with @John that both his flagfile and config returned from fleet set the logger plugin to

tls

, and that

logger_path

is not set anywhere, _ and_ we were able to run a distributed query and see that

logger_plugin

was set to

tls

(by querying the

osquery_flags

table). And yet there are still logs going to

/tmp

.