Yup. I’ll just add an rm for the /usr/local/bin osqueryd. I already have a preflight that turns off osquery using osqueryctl before dropping 5.0.1 to disk. I wasn’t sure if there was a desire to keep a symlink in place to the old binary location.
09/23/2021, 6:48 PM
We were talking, somewhere, about whether to try to detect/fix this.
09/23/2021, 8:43 PM
Cool. I think for now since I am running a pre-flight to turn off 4.9, I’ll just add another line to kill osqueryd if it exists in