seems osquery creates log files with dates in names and symlink without date in name to latest file https://osquery.readthedocs.io/en/stable/deployment/logging/