Now there is a requirement that before osquery starts directory/file need to be present in-order to be monitored. If you create the directory/file afterwards then osquery will not establish a watch on these, since when the next config refresh arrives and if it is not different than existing config then hash compare logic will not let it get through and inotify will not get chance to refresh its watch list.