<Not able to capture file events with osquery proc...
# community-feeds
r
Not able to capture file events with osquery process_file_events i was sucesful to capture file activites with file_events. But could not make the process_file_events work properly. After some file activities in monitored directory could not see any event coming to my plugin. For same plugin with same conf file the file_events are fetched successfully. the conf file is modified to contain process_file_events instead of file_events. Following is the flags file..: --disable_extensions=false --disable_events=false --disable_audit=false...