Not able to capture file events with osquery process_file_events
i was sucesful to capture file activites with file_events. But could not make the process_file_events work properly. After some file activities in monitored directory could not see any event coming to my plugin. For same plugin with same conf file the file_events are fetched successfully.
the conf file is modified to contain process_file_events instead of file_events.
Following is the flags file..:
--disable_extensions=false
--disable_events=false
--disable_audit=false...