# Auditbeat genealogy **URL:** \ **Category:** Beats\ **Tags:** auditbeat\ **Created:** [August 25, 2018, 7:17am UTC](https://discuss.elastic.co/t/auditbeat-genealogy/146003 "2018-08-25T07:17:35Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![0b501373](https://avatars.discourse-cdn.com/v4/letter/0/898d66/32.png) [@0b501373](https://discuss.elastic.co/u/0b501373)\ **Post date:** [August 25, 2018, 7:17am UTC](https://discuss.elastic.co/t/auditbeat-genealogy/146003/1 "2018-08-25T07:17:35Z")
Hoping you might have some thoughts on if its possible to track the relationships between files? Eg convert a.jpg b.jpg. I would like to know that b.jpg was created from a.jpg. Wondering if there is some magic on the backend that would allow you to see the connection between that read and write? ---
**Author:** ![cwurm](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cwurm/32/34882_2.png) [@cwurm](https://discuss.elastic.co/u/cwurm)\ **Post date:** [August 28, 2018, 11:43pm UTC](https://discuss.elastic.co/t/auditbeat-genealogy/146003/2 "2018-08-28T23:43:07Z")
I doubt it, at least not exactly - we would need to know how `convert` works - that it actually takes the contents of one file and creates another based on it (and which is which). This would be different for each command / program. What you _could_ do would be to track file accesses using the `auditd` module - though that would not track the relationship. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 18, 2018, 11:43pm UTC](https://discuss.elastic.co/t/auditbeat-genealogy/146003/3 "2018-09-18T23:43:07Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.