# \[Auditbeat\] Monitoring of files/folders with a space in the path not possible

**URL:** <https://discuss.elastic.co/t/auditbeat-monitoring-of-files-folders-with-a-space-in-the-path-not-possible/277537>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [July 1, 2021, 10:10am UTC](https://discuss.elastic.co/t/auditbeat-monitoring-of-files-folders-with-a-space-in-the-path-not-possible/277537 "2021-07-01T10:10:25Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![SECUINFRA](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/secuinfra/32/91050_2.png) [@SECUINFRA](https://discuss.elastic.co/u/SECUINFRA)\
**Post date:** [July 1, 2021, 10:10am UTC](https://discuss.elastic.co/t/auditbeat-monitoring-of-files-folders-with-a-space-in-the-path-not-possible/277537/1 "2021-07-01T10:10:25Z")

</div>

Hi,  
the monitoring of files/folders with a space in the path was not possible using auditbeat (version 7.13):

The following rules all resulted in errors:

```auto
-w /tmp/folder with space -p r -k test1
-w "/tmp/folder with space" -p r -k test2
-w '/tmp/folder with space' -p r -k test3
-w /tmp/folder\ with\ space -p r -k test4
-w "/tmp/folder\ with\ space" -p r -k test5
-w '/tmp/folder\ with\ space' -p r -k test6

```

If an auditd key containing a whitespace is used, everything after the whitespace is ignored. For example if the following rule:

```auto
-w /tmp/test -p r -k "test matched"

```

is triggered, the log only contains `"test` as auditd key.

Not sure if we missed an obvious way to escape spaces in a path. Even though paths with spaces are rather unusual for linux, it should be possible.

Note that the linux audit system (auditd) solves this issue by converting ascii strings to their hexadecimal representation, if they contain special characters (e.g. whitespaces)

Any help will be appreciated.

Kind regards

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [July 29, 2021, 12:10pm UTC](https://discuss.elastic.co/t/auditbeat-monitoring-of-files-folders-with-a-space-in-the-path-not-possible/277537/2 "2021-07-29T12:10:38Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.