3 Replies Latest reply on Nov 14, 2014 11:04 AM by chris.jeffreys

    FIM on 6.0.1

    estal8r

      I've got FIM set up to monitor a 'sensitive' folder.  I'm getting events on file creates, deletes, and writes.  However,  when I create a sub-folder underneath the monitored folder, I don't get any events at all.  Since I am monitoring this folder recursively for all files and sub-directories, I would expect to see a create or write event even when a sub-folder is created.  Is anyone experiencing this same FIM behavior?  I've attached a screenshot of the conditions for this folder.  if you have any ideas, I'd like to hear them.

      fimsetup.JPG

        • Re: FIM on 6.0.1
          nicole pauls

          Commonly what we see is it's actually the path that's not helping, not necessarily the conditions. Check the mask on the other side of the config and whether it's being applied recursively.

           

          To me, your checkboxes do look correct.

            • Re: FIM on 6.0.1
              smiller329

              I'm also having a problem with folders, and subfolders changes not getting picked up by FIM.  I tested it by making the folder/subfolder mask recursive, and created and deleted some folders.  I had also applied create and delete options for files, and when I created and deleted files, those were accurately reported.  Even in subfolders, which were new, however the creation of the subfolder was not listed in Solarwinds.

               

              It looks like it's the "folder" check above which isn't getting recognized.

            • Re: FIM on 6.0.1
              chris.jeffreys

              What does the mask field look like in your condition?  The default is *.* however directories typically don't have a . in their name.  Therefore the default condition will not pick up directory changes.  I would suggest creating a second condition for directory changes and removing the . and trailing asterisk like I have done below.