`process_file_events` table is almost empty

Bug report

What operating system and version are you using?

CentOS Linux release 8.5.2111

What version of osquery are you using?

5.7.0

What steps did you take to reproduce the issue?

I ran osquery like this:
osqueryi --verbose --audit_allow_config=true --audit_allow_sockets=true --audit_persist=true --disable_audit=false --disable_events=false --config_path /etc/osquery/osquery.conf --audit_allow_fim_events=true --audit_show_partial_fim_events=true

With the following path specified in osquery.conf:

  "file_paths": {
    "my_paths": [
      "/etc/%%"
    ]
  }

Then I tried to catch files modification/creation in /etc: /etc/test.txt (previously created) and /etc/test1.txt (created during osquery run).
Even tried to manually set auditd rules for all needed syscalls and start osqueryi without --audit_allow_config=true flag, processes and sockets works well, but not FIM.
FIM based on inode works well too, but it's not what I want to use.

What did you expect to see?

Expected to see corresponding events for all operations.

What did you see instead?

The only thing I saw in process_file_events is "unlink" operation under previously created file:

+-----------+------+------+------------+-------------+---------+--------------+---------------+-----------+-----+-----+------+------+------+-------+-------+------+------+--------+
| operation | pid  | ppid | time       | executable  | partial | cwd          | path          | dest_path | uid | gid | auid | euid | egid | fsuid | fsgid | suid | sgid | uptime |
+-----------+------+------+------------+-------------+---------+--------------+---------------+-----------+-----+-----+------+------+------+-------+-------+------+------+--------+
| unlink    | 7555 | 6915 | 1675941931 | /usr/bin/rm | false   | /etc/osquery | /etc/test.txt |           | 0   | 0   | 1000 | 0    | 0    | 0     | 0     | 0    | 0    | 3121   |
+-----------+------+------+------------+-------------+---------+--------------+---------------+-----------+-----+-----+------+------+------+-------+-------+------+------+--------+

Still trying to do something, but I cant even catch any write operations under existing files in /etc.

Start by reproducing the command and file_paths configuration from the report on CentOS, then inspect the process_file_events output for writes and creations under /etc. Compare audit-based FIM behavior with the inode-based behavior; done means expected file modification and creation events appear consistently in process_file_events.