elastic / elastic/beats

File Integrity on Linux with fsnotify backend stops tracking files on delete.

Open
#44,126 1 comment 0 reactions 1 assignee Claimed by @nicholasberlin View on GitHub
Auditbeat Team:Security-Linux Platform
Dominant language
Go
Stars
12.7k
Forks
5k
Avg merge
2d 15m
Merged PRs (30d)
385

Description

For editors like vim, a temporary file is created until it's saved, at which point the temporary file is renamed over the top of the original file. This causes fsnotify to stop tracking the file. In fsnotify's defense, the files (inodes) are different, but it's not intuitive. And is definitely not expected for File Integrity

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.