It's alleged that the watchguard is watching for hard set "osqueryd" process to monitor resource usage, and that may be causing it to crashe when the binary is renamed and launched as a service. You can follow what I did here if you want to pick up where I left off: https://osquery.slack.com/archives/C08V7KTJB/p1628315545078400

it means it can’t be renamed?

@Madhur Jodhwani not without disabling the watchguard (allegedly)

oh ok