its running as a launch daemon. -rw-r--r-- 1 root wheel files in .db and drwx------ 31 root wheel 1054 Aug 8 13:27 osquery.db