Hi all! happy Friday, I have a quick question around macOS Osquery /var/log/osquery directory 🙂 , I am sure a lot of you have noticed Apple macOS recursively emptied contents of /var/log during a major system update or migration and now the 10.15 architecture (read-only system volume) is that each minor update (10.15.1 -> 10.15.2) is treated as a full system migration, so it's currently expected that updates would clear the contents of /var/log and Osquery not built to recreate that directory, hence breaking Osquery 😞 . With that said, my question is - What everyone is doing about this? workarounds to store logs in a different directory?

You can configure osquery to write to any directory you like with

--logger_path

. Given this info, we may need to look at moving the default log directory on macOS. @seph @groob thoughts?

Thanks Zach, Yeah we are thinking about configuring osquery to write logs to a different directory. I will ask Apple what location would be preferable that macOS changes will not delete it!

Thinking….

The main problem is directory /var/log/osquery being deleted on upgrades and osquery trying to write logs to a nonexistent path

That is I think (2). I think some people would find (3) to be a larger problem. And (1) makes simple fixes harder

File an issue with Apple.

We already did! Deleted content inside /var/log/ directory is expected :) it used to be true for major upgrades and now In Catalina also true for minor updates :)

Wait what??? Apple said it’s expected?