Auditbeat 7.8 file integrity module

Hello,

I am using auditbeat to track file changes via the file integrity module. This works for a couple of minutes and logs the changes to files, but then stops working and no changes are detected anymore. Is this a known bug or am I configuring something wrong? Here is my yaml file:

 - module: file_integrity
  paths:
  - /etc/keepalived/keepalived.conf
  include_files:
  - '\.conf$'
  scan_at_start: true
  scan_rate_per_sec: 50 MiB
  max_file_size: 100 MiB
  hash_types: [sha1]
  recursive: false

Hey @Mohammad_Etemad,

How are you running Auditbeat? Are the monitored files in the same system or they are mounted using some network volume?

Could you try with the latest version of Auditbeat?

@jsoriano The service is running as a systemd service. Files are not remote, all local. I can give it a try with the latest auditbeat but I did not see any specific notes in the change logs.

Could you enable debug logging and check if you see anything related?

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.