hey @allan that's generally a no. Not sure what your setup is, but I believe the default config logs to /var/log/osquery

I tried just installing the latest deb from the osquery apt repo (for xenial). Went with a super vanilla config (just setting the

logger_path

and watchdog configs.

osqueryd

logged to both path set in my config as well as

/tmp

🤷

hmmm what version you on?

nope

not sure what you've got set up, but I've got 2.11.2 running on 1000+ machines, that don't log to /tmp =/

Interesting. You can validate that your

/tmp

directory is absent of log lines like this

osqueryd.some_host.invalid-user.log.INFO.20180522-120025.166251

?

sadly I can't do it on those hosts, I'm not cool enough to get access