then you also have to set "watched" paths in the o...
# general
m
then you also have to set "watched" paths in the osquery config, as explained on the above wiki page