Yup. I’ll just add an rm for the /usr/local/bin osqueryd. I already have a preflight that turns off osquery using osqueryctl before dropping 5.0.1 to disk. I wasn’t sure if there was a desire to keep a symlink in place to the old binary location.

We were talking, somewhere, about whether to try to detect/fix this.

Cool. I think for now since I am running a pre-flight to turn off 4.9, I’ll just add another line to kill osqueryd if it exists in

/usr/local/bin

.