Title
#general
k

Karthick

10/06/2022, 4:04 AM
Hello, I need assistance related to FIM in Linux. I have below config in osquery.conf file but the file_events table captures only the /etc/, /usr/ but not /opt { "options": { "disable_events":"false", "enable_file_events":"true", }, "file_paths": { "opt": [ "/opt/%%" ] } }
Mike Myers

Mike Myers

10/06/2022, 7:15 PM
I don't immediately see a problem with the config, but, do you think this could be a lack of filesystem permissions by the osquery agent? Is it running as root?
7:18 PM
With inotify, if you are monitoring multiple paths with all subdirectories recursively, it might be exhausting the number of things it can watch. And it will not return events.
k

Karthick

10/07/2022, 12:20 PM
@Mike Myers yeah, configured oqueryd service to run as root user and still same results, Without the file_paths flag in osquery.conf, by default it is scanning /etc, /usr. It is like default values?
t

Thomas Stromberg

10/07/2022, 2:02 PM
@Karthick - I don't believe osquery has any default FIM values, but I could be wrong. If you your host has exhausted
fs.inotify.max_user_watches
, you may see unusual behavior. To see what your systems maximum number of inotify watches is:
sysctl fs.inotify.max_user_watches
On my system, this is 524,288, but on some systems it is as low as 8192 by default. You can adjust this using
sysctl -w
. To see how many inotify watches your system currently has registered (this may not be 100% accurate):
sudo find /proc/*/fd -lname anon_inode:inotify -printf '%hinfo/%f\n' | sudo xargs grep -hc "^inotify" | awk '{s+=$1} END {print s}'
To find out how many inotify handles at a minimum watching /etc, /opt, and /usr via inotify will require:
sudo find /etc /usr /opt | wc -l
On my system this count is 613,461, which exceeds my maximum inotify watches.
2:05 PM
A scalable alternative for watching such a large file count with osquery could be connecting osquery to
auditd
or
ebpf
, and use the
process_file_events
table instead of
file_events
- as it has all filesystem events, regardless of location. The table layout is different though.
Mike Myers

Mike Myers

10/07/2022, 7:50 PM
@Karthick if you are using Fleet, it could be pushing an osquery config that does turn on FIM on those paths.
k

Karthick

10/08/2022, 3:40 AM
yes we are using fleet
10:28 AM
Thanks, @Thomas Stromberg & @Mike Myers, updating the Config in Fleet it worked.