New to OSquery. Can anyone help me understand what i am doing wrong. I am looking to enable file_events. Where exactly do i enable this feature?

i think that you need to put the flag when launching osqueryi :

osqueryi --enable_file_events

And

--disable_events=false

(since events are disabled in

osqueryi

by default)

You both are incredible awesome it worked. I have been struggling with this for over 2 days. Thank you, thank you, thank you

hi @Raf