Hi folks, I am running

process_file_events

with a couple of files in

file_paths

keys..

{
  "options": {
    "config_plugin": "filesystem",
    "logger_plugin": "filesystem",
    "logger_path": "/var/log/osquery",
    "logger_mode": 420,
    "disable_logging": "false",
    "logger_min_status": 1,
    "schedule_splay_percent": "10",
    "database_path": "/var/osquery/osquery.db",
    "utc": "true",
    "disable_audit": false,
    "audit_persist": true,
    "events_expiry": 1,
    "events_max": 50000,
    "watchdog_memory_limit": 350,
    "audit_allow_fim_events": "true"
  },
  "schedule": {
    "process_file_events": {
      "query": "SELECT * FROM process_file_events",
      "interval": "10",
      "removed": "false"
    }
  },,
  "file_paths": {
    "sys_config": [
      "/etc/osquery/osquery.conf",
      "/etc/host%"
    ]
  }
}

When I run osquery v4,3.0 as

osqueryd --config_path osquery.conf --verbose --audit_allow_config=true  --audit_debug=true

I can see relevant rules being installed.. When I make changes to the files, it doesn't show up in the logs.. after a few seconds.. osquery will dump all the audit events it read, most of it is sshd events for syscalls read and write and then crash and restart..