yes, i read the FIM doc and process-auditing doc, and config the file_paths in /etc/osquery/osquery.conf, i think maybe some config was wrong , thanks.