JohnM
05/14/2021, 2:04 PMIan Muscat
05/14/2021, 2:58 PMSELECT * FROM file_events WHERE target_path LIKE "/var/log/%%" AND action = "DELETED"
JohnM
05/17/2021, 12:30 PMIan Muscat
05/17/2021, 12:34 PMosqueryd
is started with the --disable_events=false
--enable_file_events=true
flags (or corresponding config if you’re configuring osquery using a config file). You also need to make sure that you tell osquery to monitor /var/log/%%
by specifying a config such as:
{
"file_paths": {
"logs": [
"/var/log/%%"
]
}
}
(more info on how to set this up here — https://osquery.readthedocs.io/en/latest/deployment/file-integrity-monitoring/#example-fim-config)