Auditbeat File arrival monitoring


(Prabu Rs) #1

Hi ,

I would like to monitor all files in specific directories say for ex /xxx/xxx/*
The purpose of the requirement is to monitor file arrival for batch jobs. And also would like to show to the users in kibana dashboard that this is the current files as of now. additionally want to show that what are the files arrived and what are the files missing in that directory based on the current files for as specific day or week . Just want to know is there any way to achieve this requirement in auditbeat ?

Regards
Prabu


(Adrian Serrano) #2

Hi,

I'm not sure that I fully understand your requirements, but some of them sound difficult/impossible to achieve.

First, what you're looking for is the File Integrity Module. Have a close look at the documentation.

This will allow to index events when a file is added or removed to this directory.

Afaik, building a view where you can see all the files that exist at a given moment in time is not going to be possible with the tools offered by Kibana.


(Prabu Rs) #3

Hi Adrian Serrano,

Thanks for replying back..

I understand that file integrity module is used to monitor files changes and its tracks accordingly.
But my requirement is to list the files in that directory like exact replica of linux filesystem ex ls -l /xx/xxx

Or else, is there any way to alert user via email whenever there is a new file arrived in that directory ?

Regards
Prabu


(Adrian Serrano) #4

Have a look at alerting for that

https://www.elastic.co/products/stack/alerting


(system) #5

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.