Anyway, osqueryd and osqueryi are actually the same binary. If you rename the file to osqueryi, it will behave like you want

you can just run

osqueryd -S

to launch

osqueryi

given an

osqueryd

binary

What is the thought process behind having two differently named binaries if they are actually the same?

@defensivedepth

osqueryd

and

osqueryi

were originally different, statically linked binaries. each was/is like 30-40MB. let’s say you work somewhere that is actively deploying both of these binaries to all of your production servers. let’s say you have 1,000,000 servers. by combining the two (mostly the same) binaries into one, you just saved 40 terabytes worth of storage!

Ok, I understand now