Hello all. I am new here and wanted to say hi. I have a question about osquery regarding alerting and logging. Who would be the best person to ask these to? Thank you!

Would something like this work?

SELECT * FROM file_events WHERE target_path LIKE "/var/log/%%" AND action = "DELETED"

Great, thanks! I have added this and unfortunately it is not picking up my test when I add a file to /var/log/ then delete it. Nothing in "systemctl status osqueryd -l" that provides detail of why it isn't working. Any clues? Thank you.

Are other file events showing up? When using FIM you need to make sure

osqueryd

is started with the

--disable_events=false

--enable_file_events=true

flags (or corresponding config if you’re configuring osquery using a config file). You also need to make sure that you tell osquery to monitor

/var/log/%%

by specifying a config such as:

{
  "file_paths": {
    "logs": [
      "/var/log/%%"
    ]
  }
}

(more info on how to set this up here — https://osquery.readthedocs.io/en/latest/deployment/file-integrity-monitoring/#example-fim-config)