# Error monitoring Windows folders recursively
**URL:** https://discuss.elastic.co/t/error-monitoring-windows-folders-recursively/228008
**Category:** Beats
**Tags:** auditbeat
**Created:** [April 14, 2020, 11:22pm UTC](https://discuss.elastic.co/t/error-monitoring-windows-folders-recursively/228008 "2020-04-14T23:22:50Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@FatalGlitch](https://discuss.elastic.co/u/FatalGlitch)
#### Post date: [April 14, 2020, 11:22pm UTC](https://discuss.elastic.co/t/error-monitoring-windows-folders-recursively/228008/1 "2020-04-14T23:22:50Z")
Auditbeat 6.8.7
I'm trying to use the FIM module to monitor C:\Windows in recursive, and when I do this, I just get an error as below:
`WARN [file_integrity] file_integrity/eventreader_fsnotify.go:150 fsnotify watcher error {"error": "short read in readEvents()"}`
This just repeats over and over until I stop the agent. Can someone assist with what this means and how to fix?
---
### Author:  [@FatalGlitch](https://discuss.elastic.co/u/FatalGlitch)
#### Post date: [April 14, 2020, 11:24pm UTC](https://discuss.elastic.co/t/error-monitoring-windows-folders-recursively/228008/2 "2020-04-14T23:24:42Z")
Config excerpt is below:
```
#path.home:
path.config: ${path.home}/fim/conf
path.data: ${path.home}/fim/data
path.logs: ${path.home}/logs
keystore.path: "${path.config}/fim.keystore"
auditbeat.config.modules:
path: ${path.config}/conf.d/*.yml
reload.period: 10s
reload.enabled: true
auditbeat.max_start_delay: 10s
auditbeat.modules:
- module: file_integrity
paths:
- C:/windows
- C:/windows/system32
- C:/Program Files
- C:/Program Files (x86)
exclude_files:
- '(?i)\.lnk$'
- '(?i)\.swp$'
scan_at_start: true
scan_rate_per_sec: 50 MiB
max_file_size: 100 MiB
hash_types: [sha1]
recursive: true
```
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [May 5, 2020, 11:24pm UTC](https://discuss.elastic.co/t/error-monitoring-windows-folders-recursively/228008/3 "2020-05-05T23:24:43Z")
This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.