it might also be different based on how you got osquery. I've only ever used the RPM, which drops down the relevent systemd target/init rc scripts into place. I then use configuration management tooling to run the systemd target/init rc script as a service.