DCS Intrusion Detection File Integrity Monitoring does not monitor all the files defined in the Detection Policy

Products

• Data Center Security Server Advanced

Issue/Introduction

After deploying the DCS Intrusion Detection policy you noticed that some files are not being monitored.

 

Environment

Release: 6.9.x

 

Cause

DCS allows watching a maximum of 25k files and this is defined in the Default Detection Parameters

Error in the GAI  logs collected:

ERROR:    .....  Filewatch Collector FWC_0034: File collector files limit (35(k)) has been reached. Some files are not being monitored. Increase the limit or reduce the number of files being monitored, and restart Detection service or clear and reapply Detection policy to monitor all specified files.

 

Resolution

Often reaching the maximum limit is caused by usage of "*" wildcard 

\APPLICATION_NAME\* (WINDOWS) or /APPLICATION_NAME/* (UNIX) 

Some directories store information that is not critical for integrity monitoring.

When creating Real-Time Intrusion Detection rules, it is recommended to list specific folder paths and omit the directories that are not required for watching. 

Increasing the limit of watched files is possible but not recommended and should be used as the last solution, because increasing the number of files monitored can have an impact on performance and hardware resource utilization. 

In order to increase the File Collector files limit : 

You need to check in the Security Group for this Asset , the Configuration Policy for Detection being used, and then edit/change it in Java Console :

Increase the Maximum number of Files under>Java Console> Configs>Select the Parameters currently used for the affected agent  (Default Detection parameters).>

Change the value of "Maximum number of Files(k) :"

See picture: