FIM is an event based table, meaning it doesn’t Vaseline the directories, it registers for file change notifications. This means you get the file change notification right after t happens from the OS, so there’s no delay here. The interval you specify in the config is how frequently to ask osquery for these changes

I see. Thanks. Will there be any delay if the size of monitoring directories is large?

Osquery registers with the OS to subscribe to inotify events on Linux, which tells osquery when a file has been modified or accessed, at which point either we recompute the hash or it’s given to us, I don’t recall.

Ah. So osquery depends on OS logs rather than baselining and checking hash differences right?

You can read more about it here: http://osquery.readthedocs.io/en/stable/deployment/file-integrity-monitoring/ or check out the #FIM channel :)

Ah. Thanks!

👍