Hello team, I'm using the FIM integration from ELK i have added the paths like /etc/passwd , /etc/group and /var/log/dpkg.log. I'm getting getting printed if any changes observer in /etc/passwd , /etc/group [image] But its not printing the logs if it observers any changes in /var/log/dpkg.log …

The exclusion is for files, .log files are excluded, no matter where they are or even if they are specified in the Paths to monitor. You would need to remove this exclusion.

Do FIM integration can also monitor the log files?

Elastic Security Endpoint Security

system (system) Closed March 6, 2025, 12:45pm 6

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.

Topic		Replies	Views
File integrity Monitoring with elasticsearch Elasticsearch	5	2856	June 14, 2018
Auditbeat on windows for FIM Beats auditbeat	4	1073	November 19, 2018
Tomcat log not detected after chnge the PATH on filebeat.yml Beats filebeat	11	2795	July 5, 2017
Como filtar mas logs con winlogbeat desde otra carpeta aparte de la existente Elastic en Español	2	1350	November 7, 2017
How to achieve File Integrity Monitoing with elastic Search Elasticsearch	3	549	July 6, 2018

Do FIM integration can also monitor the log files?

Related topics