Testing the RPMs, I see that the rpm does not install osqueryd. It configures it, and reloads systemd, but it’s not started.

warning: ../osquery-4.1.2-1.linux.x86_64.rpm: Header V4 RSA/SHA512 Signature, key ID c9d8b80b: NOKEY
preinstall program: /bin/sh
postinstall scriptlet (using /bin/sh):

#!/bin/sh
# Copyright (c) Facebook, Inc. and its affiliates. All Rights Reserved

# Could be called by DPKG or RPM.
# Handle the cases we want to hook or silently claim success.
case "$1" in
  configure|2)
    : # Fall through to systemctl handle.
    ;;
  *)
    exit 0
    ;;
esac

# If we have a systemd, daemon-reload away now
if [ -x /bin/systemctl ] && pidof systemd ; then
  /bin/systemctl daemon-reload 2>/dev/null 2>&1
fi
preuninstall program: /bin/sh
postuninstall program: /bin/sh