# After a folder is deleted and recreated, file\_integrity events are missing until service restart

**URL:** <https://discuss.elastic.co/t/after-a-folder-is-deleted-and-recreated-file-integrity-events-are-missing-until-service-restart/334873>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [May 31, 2023, 7:51pm UTC](https://discuss.elastic.co/t/after-a-folder-is-deleted-and-recreated-file-integrity-events-are-missing-until-service-restart/334873 "2023-05-31T19:51:18Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![James\_Nelson1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/james_nelson1/32/121690_2.png) [@James\_Nelson1](https://discuss.elastic.co/u/James_Nelson1)\
**Post date:** [May 31, 2023, 7:51pm UTC](https://discuss.elastic.co/t/after-a-folder-is-deleted-and-recreated-file-integrity-events-are-missing-until-service-restart/334873/1 "2023-05-31T19:51:18Z")

</div>

We're still on v7.17.x of auditbeat on CentOS, but I think this applies across versions. Say we are using the file\_integrity module for these paths:

```auto
- /apps
- /apps/myapp

```

When the directory /apps/myapp is deleted and re-created, we stop receiving file change events for files within the /apps/myapp directory until the auditbeat service is restarted...at which point change events will begin flowing again.

My expected/desired behavior is that we'd never stop receiving events for files within the watched paths, and the service restart would be unnecessary. Do other folks experience this? If so, are there any operational workarounds?

Thanks!

---

<div class="post-metadata">

**Author:** ![James\_Nelson1](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/james_nelson1/32/121690_2.png) [@James\_Nelson1](https://discuss.elastic.co/u/James_Nelson1)\
**Post date:** [May 31, 2023, 9:30pm UTC](https://discuss.elastic.co/t/after-a-folder-is-deleted-and-recreated-file-integrity-events-are-missing-until-service-restart/334873/2 "2023-05-31T21:30:05Z")

</div>

FWIW, given [Problems when rewatching removed directories · Issue #279 · fsnotify/fsnotify · GitHub](https://github.com/fsnotify/fsnotify/issues/279) and similar, I'm not under the impression that auditbeat is doing anything wrong. Rather, I'm curious about what options I might have to achieve the desired behavior 🙂

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 28, 2023, 11:30pm UTC](https://discuss.elastic.co/t/after-a-folder-is-deleted-and-recreated-file-integrity-events-are-missing-until-service-restart/334873/3 "2023-06-28T23:30:11Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.