# Can beats monitor file age?

**URL:** <https://discuss.elastic.co/t/can-beats-monitor-file-age/85593>\
**Category:** Beats\
**Created:** [May 12, 2017, 3:34pm UTC](https://discuss.elastic.co/t/can-beats-monitor-file-age/85593 "2017-05-12T15:34:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![PandKing](https://avatars.discourse-cdn.com/v4/letter/p/258eb7/32.png) [@PandKing](https://discuss.elastic.co/u/PandKing)\
**Post date:** [May 12, 2017, 3:34pm UTC](https://discuss.elastic.co/t/can-beats-monitor-file-age/85593/1 "2017-05-12T15:34:08Z")

</div>

Is there a method to monitor file age?  
We have a windoz app we need to monitor and one of the health checks is that it stops updating a status file.

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [May 12, 2017, 8:02pm UTC](https://discuss.elastic.co/t/can-beats-monitor-file-age/85593/2 "2017-05-12T20:02:30Z")

</div>

You could use the built in auditing feature in Windows to track writes to the file. Then use Winlogbeat to read the audit event from the Security event log. Windows should log an event anytime a process opens the file or modifies it.

From what I remember you need to enable Audit Object Access in the machines security policy (local or group). Then configure the properties of the file in question to enable auditing. Found this with a quick search: [https://blogs.technet.microsoft.com/mspfe/2013/08/26/auditing-file-access-on-file-servers/](https://blogs.technet.microsoft.com/mspfe/2013/08/26/auditing-file-access-on-file-servers/)

Then in Winlogbeat you would setup config with something like:

```auto
winlogbeat.event_logs:
- name: Security
  event_ids: 4663

```

---

<div class="post-metadata">

**Author:** ![PandKing](https://avatars.discourse-cdn.com/v4/letter/p/258eb7/32.png) [@PandKing](https://discuss.elastic.co/u/PandKing)\
**Post date:** [May 16, 2017, 1:04am UTC](https://discuss.elastic.co/t/can-beats-monitor-file-age/85593/3 "2017-05-16T01:04:36Z")

</div>

That's a great idea Andrew !  
I was posed to begin looking at one off powershell or something.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 2, 2017, 3:47pm UTC](https://discuss.elastic.co/t/can-beats-monitor-file-age/85593/4 "2017-06-02T15:47:34Z")

</div>

This topic was automatically closed after 21 days. New replies are no longer allowed.