yeah, it seems like osquery is doing this by default: https://github.com/facebook/osquery/blob/f529fc3a3088f233822ff093965ded077af3a1ed/osquery/logger/plugins/filesystem.cpp#L147-L155