08/24/2020, 10:35 PM
running into an issue w/ 
 queries and was wondering if anyone else has had the same issue or knows how to fix this — i’m using a small, custom ruleset defined in /etc/audit/audit.d/rules.d:

-b 5000000

--backlog_wait_time 0

-a always,exit -S openat
in osquery.flags i’m also setting
to ensure that when osquery runs, it doesn’t overwrite these auditd changes
in osquery.conf, i’m running a PFE query every 10 seconds on the Downloads directory:
"process_file_events": {
      "query": "SELECT * from process_file_events;",
      "interval": 10,
      "description": "auditd implementation of FIM",
      "removed": false

 "file_paths": {
    "watch_repos": [
  "file_accesses": ["watch_repos"]
it seems this combination of using custom auditd rules and osquery works well to detect when a process executes the
syscall on an pre-existing file in my Downloads directory that was already on disk when the osquery daemon was started, but not when a new file is downloaded to the same directory and a process executes
on this new file. has anyone come across this issue or have any recommended solutions so that we can use osquery to monitor syscalls on newly created files as well?


08/25/2020, 5:02 AM
You’re monitoring
which is expanded at service start to all the files in the Downloads directory. Try
I think missing the trailing slash is important) See discussion in


08/25/2020, 5:28 PM
i do want to monitor all the files in the Downloads directory though. when i set
i don’t see any PFE events generated for
. But when i set
, i do see PFE events generated for
which is what i want. i’m wondering though, if it’s also possible to download a new file to the
directory after osqueryd starts and generate PFE events for that file as well without having to restart osqueryd again.


08/25/2020, 11:49 PM
Thanks for the great explanation of what you are trying and observing. We should look into this. Do you mind creating an issue on GitHub?