Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

FIM is an event based table, meaning it doesn’t Vaseline the directories, it registers for file change notifications. This means you get the file change notification right after t happens from the OS, so there’s no delay here. The interval you specify in the config is how frequently to ask osquery for these changes 

I see. Thanks. Will there be any delay if the size of monitoring directories is large?

At the backend, how does osquery knows there’s file change? Does it monitor changes of hashes?

Osquery registers with the OS to subscribe to inotify events on Linux, which tells osquery when a file has been modified or accessed, at which point either we recompute the hash or it’s given to us, I don’t recall.

So it won’t make a difference if the directory is large

Ah. So osquery depends on OS logs rather than baselining and checking hash differences right?

You can read more about it here: <http://osquery.readthedocs.io/en/stable/deployment/file-integrity-monitoring/> or check out the <#C0L70NC1W|> channel :)