# Do FIM integration can also monitor the log files? **URL:** \ **Category:** Endpoint Security\ **Created:** [February 6, 2025, 5:12am UTC](https://discuss.elastic.co/t/do-fim-integration-can-also-monitor-the-log-files/374158 "2025-02-06T05:12:15Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![evangelin](https://avatars.discourse-cdn.com/v4/letter/e/838e76/32.png) [@evangelin](https://discuss.elastic.co/u/evangelin)\ **Post date:** [February 6, 2025, 5:12am UTC](https://discuss.elastic.co/t/do-fim-integration-can-also-monitor-the-log-files/374158/1 "2025-02-06T05:12:15Z")
Hello team, I'm using the FIM integration from ELK i have added the paths like /etc/passwd , /etc/group and /var/log/dpkg.log. I'm getting getting printed if any changes observer in /etc/passwd , /etc/group ![image](https://us1.discourse-cdn.com/elastic/original/3X/0/9/093e90f809adc3e93b8986509c921490a7dffdd6.png) But its not printing the logs if it observers any changes in /var/log/dpkg.log why?? Please response ! ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [February 6, 2025, 12:25pm UTC](https://discuss.elastic.co/t/do-fim-integration-can-also-monitor-the-log-files/374158/2 "2025-02-06T12:25:16Z")
> [@evangelin](#): > > But its not printing the logs if it observers any changes in /var/log/dpkg.log > why?? Because log files are excluded per default, check the advanced options of the FIM integration and you will see the excluded files. ![image](https://us1.discourse-cdn.com/elastic/original/3X/4/4/443692d214adf799c5f655d49d6095bb5044588d.png) Per default the `/var` path is also not monitored. ![image](https://us1.discourse-cdn.com/elastic/original/3X/1/b/1bf5bfa62eb93f2ca0c4f7d13cb325fb59b09f53.png) Keep in mind that if you set it to monitor the `/var` path rescursively and set it to monitor log files, th ---
**Author:** ![evangelin](https://avatars.discourse-cdn.com/v4/letter/e/838e76/32.png) [@evangelin](https://discuss.elastic.co/u/evangelin)\ **Post date:** [February 6, 2025, 12:32pm UTC](https://discuss.elastic.co/t/do-fim-integration-can-also-monitor-the-log-files/374158/3 "2025-02-06T12:32:17Z")
Hello Thanks for your reply when check the advance option for excluded file there was no /var path ![image](https://us1.discourse-cdn.com/elastic/original/3X/d/1/d177a281f3f7c59e04375fd0763b49eea99daab4.png) i have added the path /var/log/dpkg.log in monitor path \*\* ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/4/540c56979c0c4cce36bcb4a66e7dc55c1920a47c.png) \*\* ---
**Author:** ![leandrojmp](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/leandrojmp/32/107231_2.png) [@leandrojmp](https://discuss.elastic.co/u/leandrojmp)\ **Post date:** [February 6, 2025, 12:36pm UTC](https://discuss.elastic.co/t/do-fim-integration-can-also-monitor-the-log-files/374158/4 "2025-02-06T12:36:31Z")
The exclusion is for files, `.log` files are excluded, no matter where they are or even if they are specified in the Paths to monitor. You would need to remove this exclusion. ---
**Author:** ![evangelin](https://avatars.discourse-cdn.com/v4/letter/e/838e76/32.png) [@evangelin](https://discuss.elastic.co/u/evangelin)\ **Post date:** [February 6, 2025, 12:44pm UTC](https://discuss.elastic.co/t/do-fim-integration-can-also-monitor-the-log-files/374158/5 "2025-02-06T12:44:59Z")
OK Thank You ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [March 6, 2025, 12:45pm UTC](https://discuss.elastic.co/t/do-fim-integration-can-also-monitor-the-log-files/374158/6 "2025-03-06T12:45:40Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.