@clippy, you're correct about the "launches by default", but the systemd service overrides the

--flagfile

to

/etc/osquery/osquery.flags

(this is the same for init)