Hi I'm new with Osquery, I'm trying to set a monit...
# general
a
Hi I'm new with Osquery, I'm trying to set a monitor on some particular path like /etc/%% or /var/%%. I've started osqueryi with "sudo osqueryi --disable_events=false --config_path=/etc/osquery/osquery.conf --flagfile=/etc/osquery/osquery.flags". I'm trying to do some changes in these folders like creating a new folder or similar actions but if i do a query on the table file_events it remains always empty. Maybe am I forget some configuration? This is my osquery.flags "--watchdog_level=0 --watchdog_memory_limit=300 --disable_audit=false --audit_allow_config=true" Thanks a lot for any help!