"Input not supported" with File Integrity Monitoring on Elastic Agent

As stated in the title, once adding the FIM integration to my Ubuntu 22.04 server. The fleet agent turned "Unhealthy", and shows "input not supported". Once I remove the FIM integration, then everything works just fine and agent turned back to "Healthy" state.

[elastic_agent][info] Unit state changed audit/file_integrity-default (FAILED->STOPPED): input not supported

OS version: Ubuntu 22.04.3
Elastic Agent version: 8.8.2
FIM integration version: 1.8.0

1 Like

I recently installed Security Onion, I receive the same error in the exact same scenario when I enable FIM on the agent. I have done a lot of searching but so far I have not found a solution.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.