@Stefano Bonicatti Thanks for the info, Can u please share a sample osqueryd configuration file to enable event source /publisher/ subscriber .. for file_events checking for a particular linux directory. I have been working on this for 2 days and not reaching anywhere. Thanks.