@clippy thanks, by setting the flag: osqueryd --verbose --ephemeral --disable_database \ --disable_events false \ --disable_audit false \ --disable_logging false \ --config_path=/etc/osquery/osquery.conf \ and config the file_paths : /etc/%% but the sql : select * from file_events, can got no result. i have tested touch and VI some files in /etc/.