Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hello, I need assistance related to FIM in Linux. I have below config in osquery.conf file but the file_events table captures only the /etc/, /usr/ but not /opt
{
  "options": {
    "disable_events":"false",
    "enable_file_events":"true",
  },
"file_paths": {
  "opt": [
   "/opt/%%"
  ]
 }
}

I don't immediately see a problem with the config, but, do you think this could be a lack of filesystem permissions by the osquery agent? Is it running as root?

With inotify, if you are monitoring multiple paths with all subdirectories recursively, it might be exhausting the number of things it can watch. And it will not return events.

<@U7DT2E8B0> yeah, configured oqueryd service to run as root user and still same results, Without the file_paths flag in osquery.conf, by default it is scanning /etc, /usr. It is like default values?

<@U03K20GA48L> - I don't believe osquery has any default FIM values, but I could be wrong.

If you your host has exhausted `fs.inotify.max_user_watches`, you may see unusual behavior. To see what your systems maximum number of inotify watches is:

`sysctl fs.inotify.max_user_watches`

On my system, this is 524,288, but on some systems it is as low as 8192 by default. You can adjust this using `sysctl -w`.

To see how many inotify watches your system currently has registered (this may not be 100% accurate):

```sudo find /proc/*/fd -lname anon_inode:inotify -printf '%hinfo/%f\n' | sudo xargs grep -hc "^inotify" | awk '{s+=$1} END {print s}' ```
To find out how many inotify handles at a minimum watching /etc, /opt, and /usr via inotify will require:

```sudo find /etc /usr /opt | wc -l    ```
On my system this count is 613,461, which exceeds my maximum inotify watches.

A scalable alternative for watching such a large file count with osquery could be connecting osquery to `auditd` or `ebpf`, and use the `process_file_events` table instead of `file_events` - as it has all filesystem events, regardless of location. The table layout is different though.

<@U03K20GA48L> if you are using Fleet, it could be pushing an osquery config that does turn on FIM on those paths.

Thanks, <@U0451T25V29> &amp; <@U7DT2E8B0>, updating the Config in Fleet it worked.