# Monitoring files changes

**URL:** https://discuss.elastic.co/t/monitoring-files-changes/170552
**Category:** Beats
**Tags:** auditbeat
**Created:** [March 1, 2019, 7:35pm UTC](https://discuss.elastic.co/t/monitoring-files-changes/170552 "2019-03-01T19:35:41Z")
**Posts on this page:** 6
**Page:** 1

<div class="post-metadata">

### Author: ![mcoa](https://avatars.discourse-cdn.com/v4/letter/m/3e96dc/32.png) [@mcoa](https://discuss.elastic.co/u/mcoa)
#### Post date: [March 1, 2019, 7:35pm UTC](https://discuss.elastic.co/t/monitoring-files-changes/170552/1 "2019-03-01T19:35:41Z")

</div>

I use auditbeat for monitoring files and directories and works fine when access to file from "vim, nano, etc" . But if modify from script or cat (redirection) not capture the event.

Example:

```auto
vim /tmp/foo (edit and save) -> Detected
cat /etc/hosts > /tmp/foo -> Not detected

```

Can you helpme.

---

<div class="post-metadata">

### Author: ![olatunde.tokun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/olatunde.tokun/32/110546_2.png) [@olatunde.tokun](https://discuss.elastic.co/u/olatunde.tokun)
#### Post date: [March 1, 2019, 9:56pm UTC](https://discuss.elastic.co/t/monitoring-files-changes/170552/2 "2019-03-01T21:56:25Z")

</div>

Redirection works correctly on my FIM setup (6.6.1)

Can you share the FIM portion of your config?

---

<div class="post-metadata">

### Author: ![mcoa](https://avatars.discourse-cdn.com/v4/letter/m/3e96dc/32.png) [@mcoa](https://discuss.elastic.co/u/mcoa)
#### Post date: [March 2, 2019, 3:20am UTC](https://discuss.elastic.co/t/monitoring-files-changes/170552/3 "2019-03-02T03:20:05Z")

</div>

Hello,  
I works with auditbeat, and my rule:

```auto
[root@elk ~]# grep lala /etc/auditbeat/auditbeat.yml
    -w /tmp/lala -p wa -k change

```

Edit file with `vim`

 ![13](https://us1.discourse-cdn.com/elastic/original/3X/b/9/b9605c365c22fc4f6ce8054f1426aa05e55da355.png)

And edit file (the same) with `cat`

 ![45](https://us1.discourse-cdn.com/elastic/original/3X/e/8/e857ec85f5325b1a487a47485b1705f882079cb3.png)

Not detected process/command (only says bash)

Thanks.

---

<div class="post-metadata">

### Author: ![olatunde.tokun](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/olatunde.tokun/32/110546_2.png) [@olatunde.tokun](https://discuss.elastic.co/u/olatunde.tokun)
#### Post date: [March 4, 2019, 2:54pm UTC](https://discuss.elastic.co/t/monitoring-files-changes/170552/4 "2019-03-04T14:54:25Z")

</div>

Hi,

What I can observe is that the coreutils apps ([https://en.wikipedia.org/wiki/List\_of\_GNU\_Core\_Utilities\_commands](https://en.wikipedia.org/wiki/List_of_GNU_Core_Utilities_commands)) are identified under their execution process `/usr/bin/bash`

vim is detected as `/usr/bin/vim` while other linux coreutils (touch, echo, cat, etc) are `/usr/bin/bash`

---

<div class="post-metadata">

### Author: ![mcoa](https://avatars.discourse-cdn.com/v4/letter/m/3e96dc/32.png) [@mcoa](https://discuss.elastic.co/u/mcoa)
#### Post date: [March 5, 2019, 12:29pm UTC](https://discuss.elastic.co/t/monitoring-files-changes/170552/5 "2019-03-05T12:29:25Z")

</div>

Hello,  
I solved. Put the directory under `file_integrity` module and the changes (cat, echo, etc) are detected .

 ![56](https://us1.discourse-cdn.com/elastic/original/3X/e/c/eccfffd1046c3cc14e7001c0f2e9a50001b163b2.png)

Thanks for your help

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [March 26, 2019, 12:29pm UTC](https://discuss.elastic.co/t/monitoring-files-changes/170552/6 "2019-03-26T12:29:32Z")

</div>

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.