# Auditbeat - Triggering file integrity event.action:updated when hash.sha1 is unchanged

**URL:** <https://discuss.elastic.co/t/auditbeat-triggering-file-integrity-event-action-updated-when-hash-sha1-is-unchanged/241656>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [July 17, 2020, 2:03pm UTC](https://discuss.elastic.co/t/auditbeat-triggering-file-integrity-event-action-updated-when-hash-sha1-is-unchanged/241656 "2020-07-17T14:03:57Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mgotechlock](https://avatars.discourse-cdn.com/v4/letter/m/dc4da7/32.png) [@mgotechlock](https://discuss.elastic.co/u/mgotechlock)\
**Post date:** [July 17, 2020, 2:03pm UTC](https://discuss.elastic.co/t/auditbeat-triggering-file-integrity-event-action-updated-when-hash-sha1-is-unchanged/241656/1 "2020-07-17T14:03:57Z")

</div>

I think this is a submitted bug but it's 4 months old and no one has addressed it and it's pretty damn important. [https://github.com/elastic/beats/issues/17347](https://github.com/elastic/beats/issues/17347)

auditbeat seems to be identifying file integrity changes when the file hash has not changed.  
Version 7.7.1, 7.8  
I'm seeing hash.sha1 has not changed, but I am getting event.action:updated alerts constantly. The only difference is that file.mtime is different each time. Anyone seen this? Have a workaround/fix?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 14, 2020, 4:04pm UTC](https://discuss.elastic.co/t/auditbeat-triggering-file-integrity-event-action-updated-when-hash-sha1-is-unchanged/241656/2 "2020-08-14T16:04:00Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.