i enabled the fim through fleet ui
- /home/not_to_monitor/.ssh/%%but it seems not working, and i cannot find any record in file_events after i create or delete any files under /etc/osquery
@Kathy Satterlee could u help on this thread?
10/13/2022, 11:55 PM
I'll add an update as soon as I'm able, likely tomorrow morning (I'm in Texas).
I wasn't able to find a way to check that from within Fleet other than to check whether the file events were showing up as expected, so I reached out to the team to verify. There isn't a way to check that from within Fleet since it isn't something that
stores in a table.
You could run
enabled to see the response that's coming from the Fleet server when config is checked.
10/14/2022, 12:24 AM
ok, but how could we debug this issue?
@Kathy Satterlee could u advice?
10/14/2022, 4:45 PM
It looks like you're using
there for the platform. Overrides are applied to hosts based on the platform that comes back from
SELECT platform FROM os_version;
, so that override wouldn't apply to any hosts.
10/14/2022, 4:59 PM
sorry i dont get it, why it wouldn't apply for any hosts?
or how can i let it works out?
10/14/2022, 5:28 PM
It won't apply to any hosts because
is not a platform. You'll need to provide the actual platform you want the
to apply to.
for MacOS hosts or
for Ubuntu hosts. If you aren't sure about the platform, you can run the above query against your hosts to see what pops up!
10/14/2022, 6:11 PM
what about debian?
10/14/2022, 6:27 PM
Does that come back as
if you query your hosts?
It should be
for Ubuntu hosts for example.
10/14/2022, 9:42 PM
the screenshot of query result of SELECT platform FROM os_version; So can i say i need to define options and adding debian as new platform?