I posted an updated config that places the

file_events

table select into your schedule, that should output results for changes to

/etc/passwd

if you run

osqueryd

. If you're running

osqueryi --disable_events=false

you can

select * from file_events

.