Index: head/sysutils/osquery/Makefile
===================================================================
--- head/sysutils/osquery/Makefile	(revision 443911)
+++ head/sysutils/osquery/Makefile	(revision 443912)
@@ -1,90 +1,94 @@
 # Created by: Ryan Steinmetz <zi@FreeBSD.org>
 # $FreeBSD$
 
 PORTNAME=	osquery
-PORTVERSION=	2.4.6
+PORTVERSION=	2.5.1
 CATEGORIES=	sysutils
 
 MAINTAINER=	zi@FreeBSD.org
 COMMENT=	SQL powered OS instrumentation, monitoring, and analytics
 
 LICENSE=	BSD3CLAUSE
 LICENSE_FILE=	${WRKSRC}/LICENSE
 
 BUILD_DEPENDS=	thrift>0:devel/thrift \
 		bash>0:shells/bash \
 		linenoise-ng>0:devel/linenoise-ng \
 		asio>0:net/asio \
 		${PYTHON_PKGNAMEPREFIX}Jinja2>0:devel/py-Jinja2
 LIB_DEPENDS=	libaugeas.so:textproc/augeas \
 		libboost_regex.so:devel/boost-libs \
 		libgflags.so:devel/gflags \
 		libglog.so:devel/glog \
 		libicuuc.so:devel/icu \
 		liblz4.so:archivers/liblz4 \
 		libsnappy.so:archivers/snappy \
 		librocksdb-lite.so:databases/rocksdb-lite \
 		libthrift.so:devel/thrift-cpp \
-		libcppnetlib-uri.so:devel/cpp-netlib
+		libcppnetlib-uri.so:devel/cpp-netlib \
+		libzstd.so:archivers/zstd
 RUN_DEPENDS=	ca_root_nss>0:security/ca_root_nss
 
 USES=		cmake:outsource gmake libtool python:build compiler:c++11-lib \
 		libarchive ssl
 USE_GNOME=	libxml2
 CONFIGURE_ENV+=	OSQUERY_BUILD_VERSION="${PORTVERSION}" HOME="${WRKDIR}" \
 		SKIP_TESTS="yes" CC="${CC}" CXX="${CXX}"
 CMAKE_ARGS+=	-DFREEBSD=awesome -DCMAKE_SYSTEM_NAME="FreeBSD"
 BLDDIR=		${WRKDIR}/.build/${PORTNAME}
 USE_RC_SUBR=	${PORTNAME}d
 USE_GITHUB=	yes
 GH_ACCOUNT=	facebook ${PORTNAME}:tp
 GH_PROJECT=	third-party:tp
 GH_SUBDIR=	third-party:tp
-GH_TAGNAME=	2.4.5:tp
+GH_TAGNAME=	${PORTVERSION}:tp
 
 # Some options for things that bring in many dependencies
 OPTIONS_DEFINE=	TSK AWS YARA LLDPD
 
 TSK_DESC=		Build with sleuthkit support
 TSK_LIB_DEPENDS=	libtsk.so:sysutils/sleuthkit
 TSK_CONFIGURE_ENV_OFF=	SKIP_TSK=1
 
 AWS_DESC=		Support logging to AWS Kinesis
 AWS_LIB_DEPENDS=	libaws-cpp-sdk-core.so:devel/aws-sdk-cpp
 AWS_CONFIGURE_ENV_OFF=	SKIP_AWS=1
 
 YARA_DESC=		Build with YARA malware identification support
 YARA_LIB_DEPENDS=	libyara.so:security/yara
 YARA_CONFIGURE_ENV_OFF=	SKIP_YARA=1
 
 LLDPD_DESC=		Support Link Layer Discovery Protocol
 LLDPD_LIB_DEPENDS=	liblldpctl.so:net-mgmt/lldpd
 LLDPD_CONFIGURE_ENV_OFF=SKIP_LLDPD=1
 
 .include <bsd.port.pre.mk>
 
 .if ${OSVERSION} < 1100000
 BUILD_DEPENDS+=	clang38:devel/llvm38
 CC=	clang38
 CXX=	clang++38
 .endif
 
 post-patch:
 	${REINPLACE_CMD} -e 's|/var/osquery/|/var/db/osquery/|g' \
 		${WRKSRC}/tools/deployment/osquery.example.conf
 	${REINPLACE_CMD} -e 's|python|${PYTHON_CMD}|g' \
 		${WRKSRC}/CMakeLists.txt \
 		${WRKSRC}/tools/get_platform.py
 
 do-install:
 	${INSTALL_PROGRAM} ${BLDDIR}/osqueryi ${STAGEDIR}${PREFIX}/bin
 	${INSTALL_PROGRAM} ${BLDDIR}/osqueryd ${STAGEDIR}${PREFIX}/sbin
 	${INSTALL_DATA} ${BLDDIR}/libosquery.a ${STAGEDIR}${PREFIX}/lib
 	(cd ${WRKSRC}/include && ${COPYTREE_SHARE} ${PORTNAME} ${STAGEDIR}${PREFIX}/include)
 	${INSTALL_DATA} ${WRKSRC}/tools/deployment/osquery.example.conf \
 		${STAGEDIR}${PREFIX}/etc/osquery.conf.sample
 
-	${TOUCH} ${STAGEDIR}${PREFIX}/etc/osquery.flags
 	${MKDIR} ${STAGEDIR}/var/db/osquery ${STAGEDIR}/var/log/osquery
+	# The flags file must exist, even if empty. Using @sample
+	# prevents a populated flags file from being nuked on upgrade.
+	${TOUCH} ${STAGEDIR}${PREFIX}/etc/osquery.flags.sample \
+		${STAGEDIR}${PREFIX}/etc/osquery.flags
 
 .include <bsd.port.post.mk>
Index: head/sysutils/osquery/distinfo
===================================================================
--- head/sysutils/osquery/distinfo	(revision 443911)
+++ head/sysutils/osquery/distinfo	(revision 443912)
@@ -1,5 +1,5 @@
-TIMESTAMP = 1496944739
-SHA256 (facebook-osquery-2.4.6_GH0.tar.gz) = 85bb3cdee8e8fc37c8137d433fa0387c8df2e898e37c4c368a7d6eedfca67439
-SIZE (facebook-osquery-2.4.6_GH0.tar.gz) = 914437
-SHA256 (osquery-third-party-2.4.5_GH0.tar.gz) = 1c1021ce27a9997563a4b784b21cc03b07a6c40b65611620977d13de165efac3
-SIZE (osquery-third-party-2.4.5_GH0.tar.gz) = 3229301
+TIMESTAMP = 1497907614
+SHA256 (facebook-osquery-2.5.1_GH0.tar.gz) = 7a04670d09b59f9a278fb551fbf9bcd7ebaa5469f0e2cb069411e7733117cb04
+SIZE (facebook-osquery-2.5.1_GH0.tar.gz) = 923981
+SHA256 (osquery-third-party-2.5.1_GH0.tar.gz) = baf258578b71272b7a5a83198ae9035ae2e84c0b2ae96c2b1eb3036ab7a9fc56
+SIZE (osquery-third-party-2.5.1_GH0.tar.gz) = 3229310
Index: head/sysutils/osquery/pkg-plist
===================================================================
--- head/sysutils/osquery/pkg-plist	(revision 443911)
+++ head/sysutils/osquery/pkg-plist	(revision 443912)
@@ -1,25 +1,25 @@
 bin/osqueryi
 @dir /var/db/osquery
 @dir /var/log/osquery
-etc/osquery.flags
 include/osquery/config.h
 include/osquery/core.h
 include/osquery/database.h
 include/osquery/dispatcher.h
 include/osquery/distributed.h
 include/osquery/enroll.h
 include/osquery/events.h
 include/osquery/extensions.h
 include/osquery/filesystem.h
 include/osquery/flags.h
 include/osquery/logger.h
 include/osquery/packs.h
 include/osquery/registry.h
 include/osquery/sdk.h
 include/osquery/sql.h
 include/osquery/status.h
 include/osquery/system.h
 include/osquery/tables.h
 lib/libosquery.a
 sbin/osqueryd
 @sample etc/osquery.conf.sample
+@sample etc/osquery.flags.sample