File Integrity Monitoring at NXLOG | Log collection solutions

#1 aurox3d_fc 3 years ago

Hi,

Regarding the File Integrity Monitoring module:

Is it possible to detect the user who performs the changes? Currently, there is no detail of who made the changes in the NXLog logs.
What is the recommended scan-interval to be set? Will it affect the performance of the system?

Thank You

Permalink

#2 rafDeactivated Nxlog ✓ 3 years ago

#1 aurox3d_fc

Hi, Regarding the File Integrity Monitoring module: Is it possible to detect the user who performs the changes? Currently, there is no detail of who made the changes in the NXLog logs. What is the recommended scan-interval to be set? Will it affect the performance of the system? Thank You

Hello

im_fim doesn't provide this kind of information, you'd need to implement this kind of policy in external software to gather this information.
The scanning consumes some resources, however, not on a significant scale and it depends on many factors, especially on the number of files being monitored, but also on the infrastructure itself. The chosen interval should align with your particular policy needs. I'd encourage you to test the settings and check how it works on your system.

Best regards,
Rafal