Hi I'm new with Osquery, I'm trying to set a monitor on some particular path like /etc/%% or /var/%%. I've started osqueryi with "sudo osqueryi --disable_events=false --config_path=/etc/osquery/osquery.conf --flagfile=/etc/osquery/osquery.flags". I'm trying to do some changes in these folders like creating a new folder or similar actions but if i do a query on the table file_events it remains always empty. Maybe am I forget some configuration?
This is my osquery.flags
"--watchdog_level=0
--watchdog_memory_limit=300
--disable_audit=false
--audit_allow_config=true"
Thanks a lot for any help!