Add recursive watches to file integrity module

[andrewkroh]

The file integrity module currently supports watching individual directories and does not recursively watch sub-directories. To add support for recursive watches while still maintaining the ability to detect changes in near real-time we need notifications from the OS that work recursively (see how it works for background info).

So for the various operating systems this means

• Windows - ReadDirectoryChangesW already natively supports recursive monitoring. The feature is not exposed through fsnotify (watchSubtree is hard-coded to false). Hopefully a small change can be made to fsnotify to expose this feature.
• macOS (Darwin) - We use kqueue now which doesn't have support for recursive watches. But we can switch to using FSEvents which does support recursive watches. Plus it doesn't use as many file descriptors. One important thing to note is that multiple changes can be coalesced into a single notification (more details in this blog) and changes will be needed to account for this.
• Linux - inotify doesn't support recursive watches so we will need to implement this ourselves by adding and removing watches manually for sub-dirs.

Configuration

We can add a new configuration option like file.recursive to enable recursive watches.

- module: audit
  metricsets: [file]
  file.paths:
  - /etc
  file.recursive: true

Implementation

I would prefer to have these changes made incrementally for each operating system (e.g. one or more PR's per OS) in order to keep the changes managible from a review and testing perspective.

[andrewkroh]

This is implemented for Linux, macOS, and Windows now.

We can possibly optimize Windows more if we use ReadDirectoryChangesW with the watchSubtree flag. But we would need to do some measurements to see how the current version compares the the proposed version.

[jakommo]

Awesome, which version will this be in. 6.2?

[andrewkroh]

Yes, expect a 6.2 release for this feature.

[hmnguyen1201]

Thank you for adding this feature. It is great. I am also curious to know if there is an option to allow recursive on selected directories instead of everything?

[andrewkroh]

There are include_files and exclude_files options. See https://www.elastic.co/guide/en/beats/auditbeat/7.x/auditbeat-module-file_integrity.html.

[hmnguyen1201]

Yep, I love those settings too but sometimes it would be just much easier to be able to tell auditbeat to be recursive on certain filepaths

[andrewkroh]

I think you could split the config up into two separate modules one with recursion enabled and one with it disabled and set the paths between the two accordingly.

auditbeat.modules:
- module: file_integrity
  paths: [/c, /d]
  recursive: true
- module: file_integrity
  paths: [/a/b]
  recursive: false

[hmnguyen1201]

Thank you. This is great. It gives me a pretty good idea of what I can do.