Auditbeat 7.8 file integrity module

Elastic Stack Beats
1

Hello,

I am using auditbeat to track file changes via the file integrity module. This works for a couple of minutes and logs the changes to files, but then stops working and no changes are detected anymore. Is this a known bug or am I configuring something wrong? Here is my yaml file:

 - module: file_integrity
  paths:
  - /etc/keepalived/keepalived.conf
  include_files:
  - '\.conf$'
  scan_at_start: true
  scan_rate_per_sec: 50 MiB
  max_file_size: 100 MiB
  hash_types: [sha1]
  recursive: false
2

Hey @Mohammad_Etemad,

How are you running Auditbeat? Are the monitored files in the same system or they are mounted using some network volume?

Could you try with the latest version of Auditbeat?

3

@jsoriano The service is running as a systemd service. Files are not remote, all local. I can give it a try with the latest auditbeat but I did not see any specific notes in the change logs.

4

Could you enable debug logging and check if you see anything related?