"Input not supported" with File Integrity Monitoring on Elastic Agent

Elastic Stack Elastic Agent
1

As stated in the title, once adding the FIM integration to my Ubuntu 22.04 server. The fleet agent turned "Unhealthy", and shows "input not supported". Once I remove the FIM integration, then everything works just fine and agent turned back to "Healthy" state.

[elastic_agent][info] Unit state changed audit/file_integrity-default (FAILED->STOPPED): input not supported

OS version: Ubuntu 22.04.3
Elastic Agent version: 8.8.2
FIM integration version: 1.8.0

1 Like
2

I recently installed Security Onion, I receive the same error in the exact same scenario when I enable FIM on the agent. I have done a lot of searching but so far I have not found a solution.

3

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.