Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

image.png

I've had <https://material.security/resources/file-access-monitoring-with-osquery-weaponize-your-entire-macos-fleet-into-a-filesystem-based-honeypot|file access monitoring> enabled at my org for several months via the `es_process_file_events` table and have noticed that it will remain active, but not log any events. (first screenshot). Restarting osqeuryd fixes the problem (second screenshot) but I don't know why it stops int he first place - any thoughts?

Flags file is in :thread::

```# Fleet configurations
--config_plugin=tls
--config_tls_endpoint=/api/v1/osquery/config
--config_tls_refresh=60
--distributed_interval=10
--distributed_plugin=tls
--distributed_tls_max_attempts=3
--distributed_tls_read_endpoint=/api/v1/osquery/distributed/read
--distributed_tls_write_endpoint=/api/v1/osquery/distributed/write
--events_expiry=1
--disable_distributed=false
--enroll_tls_endpoint=/api/v1/osquery/enroll
--tls_hostname=&lt;fleet fqdn&gt;
--tls_server_certs=/var/osquery/amazon.crt
--enroll_secret_path=/var/osquery/kolide_secret

# Logs results to Fleet server 
--logger_plugin=tls
--logger_tls_endpoint=/api/v1/osquery/log
--logger_tls_period=10

# When True, each row from a snapshot event is logged individually
--logger_snapshot_event_type=true

# Sets host identifier to hostname
--host_identifier=hostname

# Disables sensitive tables
--disable_tables=shell_history

# Sets query pack delimiter to "/"
--pack_delimiter=/

# Watchdog configs
--watchdog_memory_limit=500
--watchdog_utilization_limit=130

# Eventing configurations
--disable_events=false
--disable_endpointsecurity=false
--disable_endpointsecurity_fim=false
--es_fim_enable_open_events=true
--enable_keyboard_events=true
--enable_mouse_events=true

# Displays matching rule strings from yara scan results
--enable_yara_string=true```

I've enabled verbose logging on my host specifically to see if there are any messages that are logged when/if it stops again.

we have `--events_expiry=1` in our config which I thought removes cached events in the backing store after a table is queried (not sure if this is the same number shown in the `events` column in the screenshots). We query this table every 10 seconds I believe but the number continue to grow.