FIM events fro NFS not reporting

4 views

Skip to first unread message

Veera

unread,

6:12 AM (4 hours ago) 6:12 AM

to Wazuh | Mailing List

Hi Team,

We have enabled Syscheck/FIM monitoring for NFS filesystems with realtime=no and have been monitoring for the past 3 days, but no FIM events have been reported so far.

Apart from frequent “Permission denied” warnings for certain NFS paths (such as artifacts and snapshots), there are no clear logs indicating why the Syscheck scan is completing without generating events.

The Syscheck schedule is configured to run every 12 hours, however no events have been generated to date.

What are the best commands or methods to validate the scan progress?
Is there a way to confirm whether FIM events will eventually be generated, or if the scan has failed to complete/collect data and will never report events?
Additionally, is there a way to identify which NFS files/directories are currently being scanned and whether the scan population is still dynamically growing?

Reply all

Reply to author

Forward

0 new messages