File Integrity Monitoring

Overview

When File Integrity Monitoring is enabled, the Atatus Infra Agent:

Scans configured directories for baseline hashes
Watches for changes using fsnotify, kprobes, or eBPF
Computes file hashes for verification (sha1, sha256, md5, etc.)
Applies exclusion and inclusion rules
Limits scanning throughput to avoid system overhead
Emits events whenever monitored files are changed

Both config file changes and binary changes can be monitored depending on rules applied.

Requirements

Component	Requirement
Agent	`atatus-infra-agent`
Version	4.2.0+
Supported OS	Linux
Backends	`fsnotify`, `auto`, `kprobes`, `ebpf`

Configuration File

FIM configuration lives under: /etc/atatus-infra-agent/conf.d/file_integrity.d/file_integrity.yml

Full Configuration Example

Below is your provided configuration rewritten cleanly as documentation:

metrics:
  - file_integrity:

      # Paths to Monitor (Required)
      paths:
        - /bin
        - /usr/bin
        - /sbin
        - /usr/sbin
        - /etc

      # Hash Algorithm
      # sha1 | sha256 | md5 | multiple
      hash_types:
        - sha1

      # Size & Performance
      max_file_size: "100MiB"        # Skip hashing very large files
      scan_at_start: true            # Full baseline scan at startup
      scan_rate_per_sec: "50MiB"     # Throttle scan throughput
      recursive: false               # Monitor subdirectories recursively

      # File Filtering
      exclude_files:
        - '(?i)\\.sw[nop]$'          # Vim swap files
        - '~$'                        # Temporary files
        - '/\\.git($|/)'              # Git metadata

      # include_files:
      #   - '/\\.ssh($|/)'

      # Backend Provider
      # fsnotify | auto | kprobes | ebpf
      backend: fsnotify

      # Advanced Parsers (Optional)
      # Deep metadata extraction for ELF, PE, Mach-O
      # file_parsers:
      #   - file.elf.sections
      #   - file.elf.import_hash
      #   - file.macho.sections
      #   - file.pe.sections
      #   - file.pe.imphash
      #   - file.pe.go_imports

Key Settings Explained

1. Paths to Monitor

The most critical section, it defines which files and directories are monitored. Examples:

/etc → system config
/usr/bin → executable binaries
/sbin → privileged admin tools

2. Hash Types

Defines which hash functions will be used to detect modifications.

Hash Type	Use Case
`sha1`	Default, balanced performance
`sha256`	High security
`md5`	Legacy systems

3. File Size & Performance

Setting	Description
`max_file_size`	Skip hashing files above a certain size
`scan_at_start`	Perform a full startup scan
`scan_rate_per_sec`	Throughput limit for background scanning

4. Include / Exclude Rules

You can precisely control the filesystem events to monitor:

Exclude Examples

Vim temporary files
Editor backups
Git repositories

Include Examples (if needed)

include_files:
  - '/\\.ssh($|/)'

5. Backend Providers

Backend	Description
fsnotify	Default; lightweight and fast
auto	Agent decides best backend
kprobes	Kernel-level syscall tracing
ebpf	High-performance event capture

If unsure, use:

backend: auto

Restart the Agent

sudo systemctl restart atatus-infra-agent

​Overview

​Requirements

​Configuration File

​Full Configuration Example

​Key Settings Explained

​1. Paths to Monitor

​2. Hash Types

​3. File Size & Performance

​4. Include / Exclude Rules

​Exclude Examples

​Include Examples (if needed)

​5. Backend Providers

​Restart the Agent