I usually specify
flag with the location where to put those logs (on your screenshot that flag is missing btw). I have noticed though that on Windows I never find the logs where specified, but I find them on
(or some sub-directory) , or in
depending on how I run osquery (debug/release mode). Never had the chance to investigate better though (maybe I am missing something)
set and that means some values in your flagfile could be overridden by the config returned by Fleet.