also was thinking of adding this blurb somewhere in https://github.com/osquery/osquery/edit/master/docs/wiki/installation/install-macos.md:

Note that sometimes the entire contents of /private/var/log/ can be deleted during even a point upgrade on macOS, causing logs to fail to write to disk if you're not otherwise enforcing its presence.