Best practice for handling "maximum limit of files monitored" warning in FIM

[ACH MUQODDAM]

Hi Wazuh Community,

I am getting a warning regarding the File Integrity Monitoring (FIM) module on one of my agents. The alert description is as follows:

"The maximum limit of files monitored is close to being reached. At this moment there are 168097 files and the limit is 200000. If the limit is reached some events can be lost. You can modify this setting in the centralized configuration or locally in the agent.

Wazuh Agent:

  <!-- File integrity monitoring -->
  <syscheck>

    <file_limit>
       <enabled>yes</enabled>
       <entries>200000</entries>
    </file_limit>

</syscheck>

[Md. Nazmur Sakib]

Hello,

The maximum number of files to monitor can be increased to 2147483647.

Ref: file_limit

The more files you monitor, the more resources and time the FIM scan will take. If you see daily in the FIM scan and observe any performance issues, review the FIM configuration to monitor more specific files and directories.

Ex:
recursion_level: Limits the maximum level of recursion allowed.
Ignore: List of files or directories to be ignored 

Let me know if you need further information.

[ACH MUQODDAM]

Thankyou for information