osquery’s stdout/stderr should contain the details about where its logging, and any errors its running into while writing

The only thing showing up in standard out is, "Expiring events for subscriber: process_events (overflowed limit 500000)