Help with installing Filebeat ubuntu 20.04

[Badr_Atouhlaten]

Please help to understand how [Filebeat] works,
i have elk stack installed with fleet server , system & fleet server integration installed in the stack
i have an ubuntu 18.04 added as client and i wanted to monitor /root & /home included subdirectories to be monitored for any activity (create, add, delete, modify....).
the elastic agent ins installed in the client server, i am confused not sure where will install the filebeat in the host or in the client. i am using elk stack v 8.2.2, also i want to know how to setup alert if any changes happen. Thanks

[warkolm (Mark Walkom)]

@Badr_Atouhlaten

i have an ubuntu 18.04 added as client and i wanted to monitor /root & /home included subdirectories to be monitored for any activity (create, add, delete, modify....).

You probably want to look at Auditbeat instead.

[Badr_Atouhlaten]

@warkolm

Auditbeat instead

do i have to install Auditbeat in the client or only in the host ??

[warkolm (Mark Walkom)]

I needs to be added to any host that you want to do the monitoring on.