Do FIM integration can also monitor the log files?

[evangelin]

Hello team,
I'm using the FIM integration from ELK i have added the paths like /etc/passwd , /etc/group and /var/log/dpkg.log. I'm getting getting printed if any changes observer in /etc/passwd , /etc/group

But its not printing the logs if it observers any changes in /var/log/dpkg.log
why??
Please response !

[leandrojmp (Leandro Pereira)]

@evangelin

But its not printing the logs if it observers any changes in /var/log/dpkg.log
why??

Because log files are excluded per default, check the advanced options of the FIM integration and you will see the excluded files.

Per default the /var path is also not monitored.

Keep in mind that if you set it to monitor the /var path rescursively and set it to monitor log files, th

[evangelin]

Hello
Thanks for your reply
when check the advance option for excluded file there was no /var path

i have added the path /var/log/dpkg.log in monitor path
**

**

[leandrojmp (Leandro Pereira)]

The exclusion is for files, .log files are excluded, no matter where they are or even if they are specified in the Paths to monitor.

You would need to remove this exclusion.

[evangelin]

OK
Thank You