FIM Integration 2.4.50 Empty Dashboard

[JAEP2]

Version

2.4.50

Installation Method

Network installation on Red Hat derivative like Oracle, Rocky, Alma, etc.

Description

other (please provide detail below)

Installation Type

Distributed

Location

on-prem with Internet access

Hardware Specs

Exceeds minimum requirements

CPU

16

RAM

64

Storage for /

4TB

Storage for /nsm

2TB

Network Traffic Collection

span port

Network Traffic Speeds

Less than 1Gbps

Status

Yes, all services on all nodes are running OK

Salt Status

No, there are no failures

Logs

No, there are no additional clues

Detail

Hi all,
Added the FIM integration to test in one Windows system, in other to monitoring unit e:
Created a new policy cloning previous one:

This policy have the following integrations

I tested several options E:\ E:/ etc

The healthy of the 2 agents with the policy that have FIM integrations shows that are healthy

Inputs doesn't show anything, in previous 2.4.40 (we have invalid input) after upgrade healthy ok

FIM dashboard, doesn't show any data

Thanks a lot in advanced to provided any tip, or instructions to do any test to detect the bug.

Kind regards

Guidelines

• I have read the discussion guidelines at Read before posting! #1720 and assert that I have followed the guidelines.

[cm-ops]

grep audit /opt/so/saltstack/default/salt/elasticfleet/tools/sbin_jinja/so-elastic-agent-gen-installers if that does not return anything you may be running into #12487

[JAEP2]

Hi,
The grep returns the following:
find /nsm/elastic-agent-workspace/elastic-agent-/data/elastic-agent-/components -maxdepth 1 -regex '.fleet.|.packet.|.apm.|.audit.|.heart.|.cloud.' -delete

seems I need to apply a patch..

changing this:

find /nsm/elastic-agent-workspace/elastic-agent-/data/elastic-agent-/components -maxdepth 1 -regex '.fleet.|.packet.|.apm.|.audit.|.heart.|.cloud.' -delete

for this
find /nsm/elastic-agent-workspace/elastic-agent-/data/elastic-agent-/components -maxdepth 1 -regex '.fleet.|.packet.|.apm.|.heart.|.cloud.' -delete

I will try and check the results

Thanks a lot

[JAEP2]

No changes after apply manually the patch #12487 still empty dashboards, and everything running ok, and the agents with healthy status... :( any other suggestion? Thanks a lot in advanced...

[cm-ops]

You have to regenerate the installers too. Then redeploy the agent.

[JAEP2]

Hi cm-ops!,

Works like a charm, thanks a lot

Kind regards

JAEP

[JAEP2]

Hi @cm-ops

Again stop working the FIM policy, empty dashboard again. After apply the patch and regenerate the installer works fine. But after some time stop to send info to dashboardas, health seems ok. I am still using 2.4.50 Could you confirm if FIM works well at 2.4.60? Thanks in advanced.

NOTE: I just updated to 2.4.60, FIM works perfect.

[udi-mosh]

Hi,
i have encountered the same problem in 2.4.50 but i didn't apply the patch suggested. is change was applied to 2.4.60 ?
i have upgraded to 2.4.60, and reinstalled the customized agent from the installation and FIM does not work.

thanks,
udi

[udi-mosh]

what is the correct configuration for fim ?
if i want to monitor windows, is it case sensitive ? do i have to configure c:\ or c:/ ? if i want to configure directory, do i have to end it with / or \ or nothing ?
i have tried everything and i can't get it to work.

[udi-mosh]

some update...
i have configured the paths like c:\ and enabled the collect file logs on the FIM integrity config (in 2.4.50 it through an error) and it started working. i also noticed that there were changes pending in the manager's elastic-search component so i initiated a reboot.
upon investigating the logs, i couldn't find who made the change in a file or deleted it. is this something that fim will include ?

[JAEP2]

Hi,
I'm in the same situation, i cant see who deleted files, when file is created show the owner, but I didnt found the way to see who deleted the files... Any suggestion?

Thanks in advanced