although i think that the default paths for osquery on macOS were changed to /etc/osquery from /usr/local/osquery recently (to match linux)