@Gray Cat you can only monitor files that exist at the time that osqueryd starts - it's a limitation with inotify (the underlying engine for file integrity monitoring)