@clong if you don’t mind sharing the conf file for your FIM. I created the conf but for reason, my log file hasn’t been created. I’m wondering if I should have enabled the event disabled flag as false in the conf

https://github.com/palantir/osquery-configuration/blob/master/Servers/Linux/osquery.conf https://github.com/palantir/osquery-configuration/blob/master/Servers/Linux/osquery.flags

thanks 🙂