Title
#fim
w

wennan.he

10/13/2022, 11:27 PM
Hi i enabled FIM through fleet ui and it seems not working. config: options: disable_audit: false logger_plugin: tls disable_events: false pack_delimiter: / logger_tls_period: 10 distributed_plugin: tls enable_file_events: true disable_distributed: false logger_tls_endpoint: /api/v1/osquery/log distributed_interval: 10 distributed_tls_max_attempts: 3 decorators: load: - SELECT uuid AS host_uuid FROM system_info; - SELECT hostname AS hostname FROM system_info; overrides: platforms: all: file_paths: etc: - /etc/osquery/% exclude_paths: tmp: - /tmp/too_many_events/ homes: - /home/not_to_monitor/.ssh/%% i cannot fetch any record in file_events table after creating or deleting any files under /etc/osquery/.