osquery> select * from ntfs_journal_events WHERE action = "FileWrite"; W0430 14:07:10.305126 17384 virtual_table.cpp:967] Table ntfs_journal_events is event-based but events are disabled W0430 14:07:10.305126 17384 virtual_table.cpp:974] Please see the table documentation: https://osquery.io/schema/#ntfs_journal_events

Hey @xiaoliuzi, probably you must set the '--disable-events=false' flag to make it work as given in the link below. https://osquery.readthedocs.io/en/stable/introduction/using-osqueryi/

All keyword values are -1 like this;

Probably this can give you some direction: https://dactiv.llc/blog/new-in-osquery-4.2/#ntfs_journal_events This is a new feature that I did not try yet.