To keep things clean I had to reinstall 4.9.0 and run osqueryctl stop, then reinstall 5.0.1 and start osquery. Should there be functionality for the 5.x version to stop the older versions? Moving forward I will probably have a pre-flight that turns off 4.9 prior to installing version 5.

Hey @benbass 👋, historically osquery itself hasn't provided any mechanism to do that -- it relied on however folks deployed osquery across their fleet (chef/mdm/etc). I guess it just worked out that way because all the paths, identifiers (com.facebook.osquery), etc were the same for, and macOS installer just replaces the binary. Now with the change in identifiers, code signatures, paths and app bundle, it is expected that whatever osquery is deployed with, it manages stopping the old version. This can certainly be better documented and highlighted! I will also bring this up in #C6PNW4528 tomorrow, and see what other folks think and whether going forward, we can include a preflight script of sorts

Sounds good to me - I figured I would say something since I just came across it when putting together my upgrade deployment. Thank you!

You shouldn’t need to re-install 4.9 for this, you can fish out the launchctl command.