`SELECT FROM file events `

Question

theopolis · Answer

Are you also changing something in ` etc`

theopolis · Answer

The intent of this table is to watch for changes but that watch starts at the point you start osquery

Stefano Bonicatti · Answer

Also be sure to pass ` enable file events` if you re using osquery 4 6 0

Stefano Bonicatti · Answer

Originally the INotify based publisher was automatically active as soon as one enabled events but now like the other publishers it has its own flag to enable that

theopolis · Answer

Good call

theopolis · Answer

I think osquery would report `Subscriber disabled via configuration` for `file events` if this were 4 6 0