Hey, I see this question asked couple of times in the past, but can't find an answer, so I will ask again: we are monitoring "/etc", but since there are files/directories there that are symlinks to /usr/share or other, is there a way to tell osquery to not monitor symlinks?

@Todor Petkov you could consider joining

file_events

and

file

tables and adding a WHERE clause that filters

type

values of "symlink".