i enabled the fim through fleet ui overrides: platforms: all: file_paths: etc: - /etc/osquery/% exclude_paths: tmp: - /tmp/too_many_events/ homes: - /home/not_to_monitor/.ssh/%% but it seems not working, and i cannot find any record in file_events after i create or delete any files under /etc/osquery

@Kathy Satterlee could u help on this thread?

I wasn't able to find a way to check that from within Fleet other than to check whether the file events were showing up as expected, so I reached out to the team to verify. There isn't a way to check that from within Fleet since it isn't something that

osquery

stores in a table.

You could run

osqueryd

with

--tls_dump

enabled to see the response that's coming from the Fleet server when config is checked.

@Kathy Satterlee could u advice?

or how can i let it works out?

For example,

darwin

for MacOS hosts or

ubuntu

for Ubuntu hosts. If you aren't sure about the platform, you can run the above query against your hosts to see what pops up!

It should be

ubuntu

for Ubuntu hosts for example.