since <osqueryd.INFO/ERROR/WARNING> are symlinked,...
# general
c
since osqueryd.INFO/ERROR/WARNING are symlinked, do you think you need the wildcards? or would "osqueryd.INFO" work?