zahida naeem
08/22/2022, 8:11 AMKathy Satterlee
08/22/2022, 3:08 PM=
.
—config_path=/path/to/file.conf
"file_paths": {
"root": [
"/%"
]
You'll only see changes in files that are directly in the root path. Is that where your test file is located?zahida naeem
08/23/2022, 9:17 AMsharvil
08/23/2022, 9:51 AM--enable_file_events=true
in your flags (sorry if it's already there and I missed it), can you also add --verbose
to turn on verbose logging in care there are any debug messagesKeith Swagler
08/23/2022, 12:35 PM"tmp": [ "/home/slyb/Downloads/%", "/tmp/%" ]
sharvil
08/23/2022, 4:22 PMzahida naeem
08/23/2022, 4:41 PMKeith Swagler
08/23/2022, 4:44 PMselect * from file where path = $testfile
sharvil
08/23/2022, 4:44 PMfile_events
query would be in /var/log/osquery/results.log
, is that not the case?osquery
as root, so that it has permission to the files you want monitored
• disable all other queries and packs for now, and just schedule the file events query
• make sure the file you want monitored are less than 50MB in size (or adjust with --read_max
flag)Keith Swagler
08/23/2022, 5:42 PMosqueryd.snapshots.log
file under /var/log/osquery/
zahida naeem
08/23/2022, 5:52 PMsharvil
08/23/2022, 5:54 PMzahida naeem
08/24/2022, 4:42 PMKathy Satterlee
08/24/2022, 4:46 PMosqueryi
as root there?zahida naeem
08/24/2022, 4:47 PMKathy Satterlee
08/24/2022, 5:50 PMzahida naeem
08/24/2022, 6:34 PM