# Linux Auditd monitoring of file operations in mounted folder

**URL:** <https://discuss.elastic.co/t/linux-auditd-monitoring-of-file-operations-in-mounted-folder/314940>\
**Category:** Beats\
**Tags:** auditbeat\
**Created:** [September 22, 2022, 12:21pm UTC](https://discuss.elastic.co/t/linux-auditd-monitoring-of-file-operations-in-mounted-folder/314940 "2022-09-22T12:21:51Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Lukas\_Hubl](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/lukas_hubl/32/100118_2.png) [@Lukas\_Hubl](https://discuss.elastic.co/u/Lukas_Hubl)\
**Post date:** [September 22, 2022, 12:21pm UTC](https://discuss.elastic.co/t/linux-auditd-monitoring-of-file-operations-in-mounted-folder/314940/1 "2022-09-22T12:21:51Z")

</div>

I have multi node kubernetes cluster and I would like to monitor file operations that are made by containers in mounted persistent volume. I found the all PV data are located at nodes in `/var/lib/kubelet/pods/<container-uid>/volumes/kubernetes.io~csi/<pv-name>/mount`. So I have auditd rules like this:

```auto
-w /var/lib/kubelet/pods -p r -k fileops_cdr_read
-w /var/lib/kubelet/pods -p w -k fileops_cdr_write
-w /var/lib/kubelet/pods -p x -k fileops_cdr_exec
-w /var/lib/kubelet/pods -p a -k fileops_cdr_append

```

Containers are created and deleted dynamically, so I don't know the container-uid beforehand, so I can't set the specific rule for each container - that's the reason why I set monitoring for the parent folder.

When a container with mounted data exists before auditbeat deployment, then auditing works as expected. But if a container is created when the auditbeat is already deployed, then file operations in ../mount folder are not captured. After redeployment of auditbeat everything works as expected.

I investigated, when you manipulate data anywhere else than /mount folder, all events are audited. But no events are captured in /mount folder - when you don't restart auditbeat.

Is there any way how to achieve monitoring of mounted folder, when I don't know the container uid beforehand?

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 20, 2022, 2:21pm UTC](https://discuss.elastic.co/t/linux-auditd-monitoring-of-file-operations-in-mounted-folder/314940/2 "2022-10-20T14:21:54Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.