Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

where is the place where default directory for augeas lenses is defined? I am looking in osquery/osquery/tables/system/posix/augeas.cpp, but that does not seem to stick.

<https://github.com/facebook/osquery/blob/a41ff4117faa1b28e6a11364c4d02f4a5aa4e8bf/osquery/tables/system/posix/augeas.cpp#L25>

macOS: /private/var/osquery/lenses
Others: /usr/share/osquery/lenses

thanks, that's where I thought it should have been

The take away is to make changes to code _after_ make sysprep runs, not before.