Hi all, some teams installing osquery are currently annoyed the current rpm tries to install a file under /etc/init.d/ when this directory is not present on their rhel9 box. I see an old issue which may be somewhat relative https://github.com/osquery/osquery/issues/7949. We are working on the fix internally by modifying osquery and osquery-packaging to only install a file post installation under /etc/init.d/ if that directory exists on the host. We keep forks of osquery and osquery-packaging. Would you be interested in those contributions? We could remove init support totally as well, but we don't want to give other people reasons to not install osquery.

Yes, I think we'd take those patches. I don't know what the right way to handle it is. Possible by shipping the init.d script over in the docs. Or by using a postinst to determine whether to use systemd or init

My manager also filed an issue https://github.com/osquery/osquery-packaging/issues/27 . I have a branch locally I still need to test. It follows: • stop installing the SysV init script directly to `/etc/init.d`; stage to

/usr/share/osquery/initd

instead • postinst (from osquery build artifacts) copies it to

/etc/init.d

only when the directory exists • RPM:

%ghost /etc/init.d/osqueryd

for proper file tracking and clean uninstall • DEB: reference

postrm

from build artifacts for cleanup on removal

We'll try to get those reviewed