FIM is an event based table, meaning it doesn’t Vaseline the directories, it registers for file change notifications. This means you get the file change notification right after t happens from the OS, so there’s no delay here. The interval you specify in the config is how frequently to ask osquery for these changes
g
Gray Cat
02/28/2018, 5:26 PM
I see. Thanks. Will there be any delay if the size of monitoring directories is large?
At the backend, how does osquery knows there’s file change? Does it monitor changes of hashes?
t
thor
02/28/2018, 7:06 PM
Osquery registers with the OS to subscribe to inotify events on Linux, which tells osquery when a file has been modified or accessed, at which point either we recompute the hash or it’s given to us, I don’t recall.
So it won’t make a difference if the directory is large
g
Gray Cat
02/28/2018, 7:09 PM
Ah. So osquery depends on OS logs rather than baselining and checking hash differences right?