File Sight Is Missing My Changes

File Sight is able to monitor changes to all files so if you aren't seeing the change events you're expecting there is usually a configuration issue to blame.

There's alots of configuration settings for File Sight Monitors so work through this page to check that one of the settings isn't causing your changes to get missed

A few things to check

General Settings

• Make sure the "Monitor subdirectories" is checked at the top of the Monitor's configuration if the changes you are missing are in a subdirectory of the monitored folder.
• You may want to check "Fire actions for each event separately" in case the event you think are missing are being sent out together with another event.
• Similar to the above, multiple alerts can get combined into a single email (see the email action's Advanced Options > Enable Message Digests setting).
• Use the "View Live Logs" to see the current activity that File Sight is seeing and try making example changes to see if they show up (on busy systems, using the "Only show lines containing" filter box will help cut down the noise)
• File Sight monitors files on local drives only (where the Central Monitoring Service or a Satellite Monitoring Service is installed). That means it cannot monitor files on shared folders, even if the shared folder is mapped to a drive letter.

Watch Tabs

Check the following settings under the Watch tabs

File Types

• Make sure that the File Types being monitored includes the change you are looking for (you can just specify * to capture all file types)

File Activities & Directory Activities

• Make sure the file activities for the event you are missing are checked
• (File Activities Tab Only) If you are monitoring file reads and writes, make sure that the "Minimum # of bytes read or written in order to get reported" settings is set low enough to catch the changes you are missing.
• If you want to receive alerts for these activities, be sure the green "Fire actions if the above activities occur" checkbox is checked

User Activities

• If you only want to be alerted when users have triggered one of the rules on the User Activities tab (above screenshot) and not be alerted for each thing a user has done, make sure to uncheck the box on the File Activities tab called "Fire actions if the above file activities occur"

Streams and Behaviors

• You may need to change the "Interpret application behaviors" check box for your changes to show up (see here for an explanation of what that checkbox does)

Ignore Tabs

Check the following settings under the Ignore tabs

File Types

• Check that the extension (or other pattern that would match) of the change you are missing isn't listed as a File Type

Subdirectories

• You aren't ignoring the subdirectory the change is occurring in, note that subdirectories are match at any point in the path so adding a subdirectory of "TEMP" here will ignore all of the following C:\TEMP\file.txt, C:\WINDOWS\TEMP\file.txt and C:\TEMPORARY\file.txt

Users

• The User that's making the changes isn't ignored under the User's tab

Processes

• The process that's making changes isn't ignored under the Processes tab
• All activity arriving from the network will use the "System or Network" process, so you probably should not ignore that process

Additional Troubleshooting Suggestions

• Add a Message Box action to the monitor. This will help you quickly see if the monitor is seeing the file actions you are watching for
• If using the Ultra Edition, run a report or view the Recent Alerts section on the Server Status report. This will test if the file activities are getting written to the database.