Hey guys, I wanted to follow up on the

process_file_events

table behaviour. The FIM feature using linux audit just won’t emit any events. I can see that

--audit_fim_debug

and

--fim_debug

flags are able to see the events but it just won’t emit any events. Audit logs generated by

auditd

: https://paste.ubuntu.com/p/njSmddpkMc/ Verbose logs generated by `osqueryd`: https://paste.ubuntu.com/p/kQGrZPjVtP/ osquery config: https://paste.ubuntu.com/p/8VT9wVrNhb/ system info: https://paste.ubuntu.com/p/gV52B4Hd7M/ This is in relation to the question where the linux audit system will never emit a Write based syscall and only emit an open or openat syscall with the relevant write flags to specify the intent of the file open which should be used to detect events. In the above example, I was using (the same thing would happen with vim, it would only use openat and other rename and unlink syscalls)

echo "foo" >> ~/.ssh/authorized_keys

which would just emit a

openat

syscall with

O_WRONLY|O_CREAT|O_APPEND

flags. osquery would then mark it as state change but not emit event as it’s not a write (

is_write_operations

remains false) syscall and gets ignored in

if (!FLAGS_audit_fim_show_accesses && !is_write_operation) {
	return false;
}