Logchase
Book a demo

File integrity monitoring (FIM) for Linux & Windows: Every change. Visible. Traceable. Under control.

Monitor critical files and directories across Linux and Windows. Understand what changed, when it happened and who was involved.

Book a demoExplore FIM
  • Linux
  • Windows
  • Continuous monitoring

Know what changed.
And why it matters.

File integrity monitoring (FIM) gives you visibility into changes across critical files, directories and configurations, helping you detect unauthorized modifications and understand their impact.

Detect modifications

Identify creations, deletions, modifications and renames across Linux and Windows.

Review the details

See file diffs, metadata, user and process context for every change.

Prioritize the response

Distinguish expected and authorized changes through context and focus on what matters most.

Detailed change visibility

From a file event
to the full story.

See exactly what changed, compare file versions and understand the context behind every event.

  • File created, modified, deleted or renamed
  • Permission and ownership changes
  • Hash comparison
  • User and process context

Flexible monitoring

Monitor what matters.
Tune out the rest.

Create scope-based rules for critical system files, application directories and configuration files. Focus on the changes that are relevant to your environment.

  • Flexible path and file rules
  • Severity-based alerts
  • Linux and Windows agents

How it works

How Logchase file integrity monitoring works

Logchase FIM uses lightweight agents on your Linux and Windows hosts. You choose the paths to watch in the Logchase console; each agent records a baseline and compares every new scan against it.

  1. 1

    Record a baseline

    The agent stores each monitored file's SHA-256 hash, size, permissions and owner, so there is a known-good state to compare against.

  2. 2

    Detect the change

    New, modified, deleted and renamed files show up against the baseline, along with permission and ownership changes. Text files get a line-by-line diff.

  3. 3

    Set the severity

    Changes to critical files such as /etc/shadow, /etc/sudoers or the Windows hosts file are raised as critical. Deletions are high severity by default.

  4. 4

    Investigate in context

    File events sit next to your other logs, so you can line a change up with logins, processes and network traffic in SIEM and log management.

If an agent stops sending heartbeats, Logchase marks it inactive and sends a notification, so a silent agent is never mistaken for a quiet server.

Linux and Windows

Start with the paths below. They hold accounts, access rules, scheduled tasks, startup items and web content, the places attackers usually change first. Then add your own application directories.

Linux

File integrity monitoring on Linux

On Linux, the Logchase FIM agent runs as a systemd service and scans the directories assigned to it in the console. Temporary, swap and cache files are skipped by default, so they do not bury real changes.

Recommended paths to monitor

/etc/passwd/etc/shadow/etc/group
Local accounts and password hashes. An unexpected entry can be a backdoor account.
/etc/sudoers/etc/sudoers.d/
Who may run commands as root, a common privilege escalation target.
/etc/ssh/sshd_config/root/.ssh/authorized_keys
SSH access rules and keys. Attackers add keys to keep their access.
/etc/crontab/etc/cron.d//etc/systemd/system/
Scheduled jobs and services, frequent persistence points.
/var/www/
Web application files. New or modified scripts can be a webshell.
/bin/sbin/usr/bin/usr/sbin
System binaries. A replaced binary points to tampering or a rootkit.

By default, Logchase reports changes under /etc, /bin, /sbin, /usr/bin and /usr/sbin as high severity, and changes to files such as /etc/shadow, /etc/sudoers and sshd_config as critical.

Windows

File integrity monitoring on Windows

On Windows, a PowerShell-based Logchase agent hashes files with SHA-256 and reports changes, with diffs for text files, to the same console as your Linux servers.

Recommended paths to monitor

C:\Windows\System32\drivers\etc\
hosts, lmhosts and services. An edited hosts file quietly sends a domain to another address.
C:\Windows\System32\config\
Registry hive files such as SAM, SECURITY, SYSTEM and SOFTWARE, which hold accounts and system settings.
C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Programs that run at sign-in, a classic persistence location.
C:\inetpub\wwwroot\
The IIS web root. New .aspx or .ashx files deserve a closer look.
web.configappsettings.json
Connection strings, authentication and security settings of your applications.

When no paths are assigned, the Windows agent watches the first three locations. Files such as hosts, SAM and SYSTEM are reported as critical, deletions as high and other modifications as medium severity.

Use cases

Protect your critical paths.

Logchase FIM helps you monitor the areas that matter most, from system configurations to application files.

Webshell detection

Detect unexpected changes in web directories, such as /var/www/html/.

Configuration monitoring

Track changes to critical system configurations like /etc/.

Ransomware indicators

Identify unusual mass file changes that may indicate ransomware activity.

Insider activity review

Review file changes with user and process context for accountability.

Support compliance monitoring:

PCI DSSISO 27001

Use cases in detail

What FIM catches in practice

Webshell detection in web directories

A webshell is a small script, usually PHP, ASPX or JSP, that an attacker places on a web server to run commands through ordinary HTTP requests. It typically arrives through a vulnerable upload form, plugin or unpatched application and then hides among legitimate files. FIM catches the moment it lands: Logchase flags new files in web directories such as /var/www/html or C:\inetpub\wwwroot, shows a diff when an existing page is modified, and records the hash, owner and time. Correlate the file event with web server and firewall logs to find the request that delivered it.

Configuration monitoring and drift

Many incidents begin with one line in a configuration file: PermitRootLogin switched to yes, a new entry in sudoers, a changed DNS resolver or a hosts file that points a domain somewhere else. Logchase FIM watches configuration files under /etc, your application directories and the Windows drivers\etc folder, and shows the exact line that changed in a before-and-after diff. Because every change carries the host, time, user and process, you can tell a planned change from configuration drift or tampering, and use the change history as evidence in audits and post-incident reviews.

Ransomware indicators on monitored paths

Ransomware has to touch files to do damage. It rewrites, renames and deletes large numbers of them in a short time, often adding extensions such as .locked or .encrypted. On monitored paths, FIM sees this as a sudden burst of modification, rename and deletion events. Logchase reports deletions as high severity by default, and its rule library includes a template that alerts on known ransomware file extensions in your logs. Seeing which host, user and process started the burst helps you isolate the right machine quickly and work out which files need to be restored from backup.

Insider and privileged activity review

Not every risky change comes from outside. Administrators and service accounts have broad access, and a mistake or misuse looks exactly like routine work until someone reviews it. Logchase FIM records which user and process changed a file, together with permission and ownership changes, so privileged activity stays accountable. The rule library also includes a template for mass file deletion by an administrator account. Role-based access control lets auditors and team leads review this activity without full administrative rights, and the change history gives you a clear record when questions come up later.

Technical specifications

Built for detailed change visibility.

Change tracking

  • File created
  • File modified
  • File deleted
  • File renamed

Integrity checks

  • SHA-256 verification
  • Previous and current hashes
  • Change history
  • Verification context

Monitoring controls

  • Directory scope
  • Filename patterns
  • Alert severity
  • Environment

Alert levels

The right detail.
The right priority.

Configure priorities around your environment.

High

Critical system file change

Modification to /etc/sudoers by root on web-01.

Medium

Application configuration update

Change to /etc/nginx/nginx.conf by www-data on web-01.

Low

Monitored log file change

Update to /var/log/app.log by app on db-01.

Compliance

File integrity monitoring and compliance

Several security standards expect you to detect unauthorized changes to critical files. Logchase FIM supports these compliance workflows with change records, hash comparisons and alerts you can show to an auditor.

PCI DSS

PCI DSS v4.0 requirement 11.5.2 calls for a change-detection mechanism, such as file integrity monitoring, that alerts personnel to unauthorized changes, additions and deletions of critical files and compares critical files at least once a week. Requirement 10.3.4 asks for FIM or change detection on audit logs, so existing log data cannot be changed without an alert.

ISO/IEC 27001

Annex A of ISO/IEC 27001:2022 expects configurations to be monitored and reviewed (8.9), logs to be produced and protected (8.15) and systems to be monitored for anomalous behavior (8.16). FIM change records help you show that these controls work in practice.

KVKK and GDPR

Both require appropriate technical measures to protect personal data (KVKK Article 12, GDPR Article 32), and GDPR explicitly names the ongoing integrity of processing systems. Detecting unauthorized changes on servers that hold personal data is part of that picture.

Logchase supports these compliance workflows; it is not a certification, and meeting a standard still depends on your own policies and assessment. Log archives in Logchase are also hashed and timestamped, which helps show that the evidence itself has not changed. Explore log management

FAQ

Frequently asked questions

Common questions about file integrity monitoring in Logchase.

What is file integrity monitoring (FIM)?

File integrity monitoring detects changes to critical files, directories and configurations, so you can spot unauthorized changes early and see what changed, when and by whom. To compare products, read File integrity monitoring tools: what to look for.

Which operating systems does Logchase FIM support?

Linux and Windows. Both agents report to the same Logchase console, so you review changes from all your servers in one place.

What changes are tracked?

File creation, modification, deletion and renaming, plus permission and ownership changes. Each change shows a diff, SHA-256 hash comparison and the user and process involved.

How does FIM help detect webshells?

When an unexpected file appears in a web directory or an existing file is modified, FIM detects the change and raises an alert; webshell uploads often surface this way first.

How do you separate expected changes from unauthorized ones?

Monitoring rules and severity levels separate expected, authorized changes so your team focuses on what matters.

How does FIM work with SIEM?

In Logchase, file events live next to your other logs, so you can correlate a file change with login, process and network activity from the same time. See how this works in Logchase SIEM.

Make critical changes visible.

Strengthen your security posture with file integrity monitoring from Logchase.

Book a demoExplore log management