wave I m struggling to get FIM file access working on MacOS

Question

wave I m struggling to get FIM file access working on MacOS FIM is working and I have `file accesses` in my config What else could I be forgetting

Ben · Answer

My flags current look like ``` disable extensions disable events=false enable file events=true disable audit=false audit allow config=true audit persist=true audit allow fim events=true audit allow process events=true```

Ben · Answer

And my FIM config for testing ``` file paths tmp tmp exclude paths tmp tmp do not monitor1 file accesses tmp ```

Ben · Answer

I see `CREATED` `ATTRIBUTES MODIFIED` and `DELETED` events for files in tmp but no access events

allister · Answer

that s more than I was expecting you d be able to achieve I don t recall if a kext was ever required for those type of things

allister · Answer

santa is how demGoogs do FIM so there is that sysext based way to accomplish the same goal AFAIK that feature came along for the conversion to sysext

Ben · Answer

I can explore Santa but would be ideal to get it done with just osquery

theopolis · Answer

You should be able to get FIM working on macOS without configuring audit Audit is only used for `process file events` the `file events` table is populated through FSEvents Let me look at the code quickly and try to guess why the accesses is not working for you

Ben · Answer

Thanks < theopolis> I also want to explore the `process file events` but primarily would like to get `file events` with accesses working first