Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

Hi i enabled FIM through fleet ui and it seems not working.
config:
  options:
    disable_audit: false
    logger_plugin: tls
    disable_events: false
    pack_delimiter: /
    logger_tls_period: 10
    distributed_plugin: tls
    enable_file_events: true
    disable_distributed: false
    logger_tls_endpoint: /api/v1/osquery/log
    distributed_interval: 10
    distributed_tls_max_attempts: 3
  decorators:
    load:
      - SELECT uuid AS host_uuid FROM system_info;
      - SELECT hostname AS hostname FROM system_info;
overrides:
  platforms:
    all:
      file_paths:
        etc:
          - /etc/osquery/%
      exclude_paths:
        tmp:
          - /tmp/too_many_events/
        homes:
          - /home/not_to_monitor/.ssh/%%

i cannot fetch any record in file_events table after creating or deleting any files under /etc/osquery/.