don't seem to show what I need, and I can't find an example of how to make the
queries work. Am I barking up the wrong tree? Can osquery detect those kinds of file system events?
? If you're trying in
select * from disk_events
you will need
. afaict this provides the information you are looking for.
so that's probably it
with events disabled.