Does your osquery.conf include the file paths you are trying to monitor?