Wazuh FIM "not detecting" a changed file usually means it has not looked yet

You add a directory to Wazuh file integrity monitoring, change a file, and nothing happens. On Wazuh 4.14.7 the usual reason is the schedule, not a bug. We measured it on a manager container.

The defaults

The <syscheck> block in the 4.14.7 manager image's default ossec.conf:

<frequency>43200</frequency>
<scan_on_start>yes</scan_on_start>
<alert_new_files>yes</alert_new_files>
<directories>/etc,/usr/bin,/usr/sbin</directories>
<directories>/bin,/sbin,/boot</directories>

43200 seconds is 12 hours. No directory has realtime or whodata. So a changed file is reported at the next scheduled scan, up to 12 hours later.

What we measured

Two test directories, one plain and one with realtime="yes", files changed after the first scan:

What we did	Alert
first scan after start, files already present	none: the first scan only records a baseline
changed a file in the plain directory, default 12 h interval, waited 25 s	none
same, with <frequency>60</frequency>	rule 550, level 7, mode scheduled, after about 64 s
changed a file in the realtime directory	rule 550, level 7, mode realtime, within seconds
created a new file there	rule 554, level 5, mode realtime

How to check in a minute

grep '(6003)' /var/ossec/logs/ossec.log | tail -n 20     # monitored paths and their options
grep -E '\(600[89]\)' /var/ossec/logs/ossec.log | tail -n 4   # last scan start (6008) and end (6009)

If your path's (6003) line does not end in realtime (or whodata), changes wait for the next scan. If the path is not listed at all, it is not monitored.

The fix

Real-time on the paths you would actually act on, on the agent or in the group's agent.conf:

<syscheck>
  <directories realtime="yes" check_all="yes">/etc/nginx,/var/www/app/config</directories>
</syscheck>

After the restart, the (6003) line for that path ends in realtime, followed by (6012): Real-time file integrity monitoring started.

Keep real-time to small, meaningful directories: real-time on large or busy trees is how FIM turns into noise. And when you test, wait for the (6009) scan-ended line before changing a file, because changes before the baseline exists are not alerts.

Limits

Measured on a Wazuh 4.14.7 manager container, with wazuh-syscheckd monitoring its own Linux filesystem; agents use the same module, but we did not run a separate agent. Not measured: whodata, Windows, network shares, inotify limits on very large directories, real-time noise on a busy server.

Full note: https://atkvn.com/fix-wazuh-fim-not-detecting-file-changes.html

Dong Nguyen, ATK New Technology. We check and fix Wazuh rules for people who run it.