File activity is not logged in investigation dashboard or reports


There is no file activity logged in the investigation dashboard or predefined reports, such as: File Activities, File Entitlement, Files Count of Activity Per Client, Files Count of Activity Per Server, Files Count of Activity Per User, Files Privileges

Resolving the problem

Check the following:
  • Verify the FAM license is installed and the S-TAP is active
  • Make sure you are not logged in as root in your file server for activities. Activities from root, (UID0) are not logged by default.
  • On Linux/AIX, check the file path specified in your policy rule. For example, /testdir/ monitors a file called testdir and not the files in a directory called testdir. Specify /testdir/* to monitor files in the testdir directory.
  • On Windows, if you use domains and your policy rule specifies a user, make sure the domain is specified. For example, svldev\Maryjane instead of just Maryjane.