FIM is free, open-source software that monitors file system changes in the background and keeps historical information about files. It emits events when monitored files change, generates file hashes and analyzes changes to content, attributes, ownership and permissions. On Linux, using the Audit daemon, it can identify who caused an event and which command produced it. Events can be written to a local file, sent over a network, or delivered to both destinations. Listed integrations include Elasticsearch 8.x or OpenSearch 2.x and Splunk indexer 9.x, although only one can be active at a time. FIM is deployed on premises and supports Linux, Windows and macOS. Listed minimum requirements are one CPU core, 128 MB of memory and 1 GB of storage; storage use grows over time. Supported systems include Ubuntu Xenial or later, CentOS 7 or later, Windows 7 or Windows Server 2016 or later, and macOS Big Sur or later. The maker says support is free and provides support by email.
Who it is for
FIM suits users who want on-premises file-change monitoring on Linux, Windows or macOS. Its event details and listed integrations may also suit teams sending monitoring data to an indexer.
What is good
- Free, open-source software with no stated usage limits.
- Tracks changes to content, ownership and permissions.
- Linux Audit daemon can identify event-causing users and commands.
- Events can be sent locally, over a network, or both.
- Runs on Linux, Windows and macOS.
What to know first
- Only one listed integration can be active at a time.
- Storage use increases over time.
- Minimum listed storage requirement is 1 GB.
- Agentless monitoring is not supported.
Verdict
FIM provides file-change events, historical data and integrity checks across three desktop operating systems. Its on-premises deployment and one-integration-at-a-time limit are important considerations for setup.
FIM plans and pricing
All plansCompared on file integrity monitoring software
- Free plan
- Yes
- Deployment
- on_premises
- Real-time alerts
- Yes
- Agentless monitoring
- No
- Supported platforms
- Linux (Ubuntu, CentOS), Windows, macOS
