FIM is a utility designed to monitor changes in files, not to make backup copies, so you will have to adapt the process to recover the data. Currently, during FIM's operation, the changes detected through the report_changes option are saved in the /var/ossec/queue/diff/ directory, where a directory structure will be created, for example, in the Wazuh manager, for a file /etc/myfile, the change made will be reflected in: /var/ossec/queue/diff/local/etc/myfile/, where a file last-entry.gz will exist.
Note that this gz file contains only the last change made, but this is reset at every start as follows:
- When Wazuh starts, any content in
/queue/diff is deleted.
- In the initial scan, a copy of all files with
report_changes enabled is stored in /queue/diff.
- Whenever there is a modification to those files, their contents are checked and compared with the stored files (
diff command).
- If there are differences, the
What changed field is added to the alert, and the content of the stored files is updated in /queue/diff.
This means that if you make a change to a file and the content is lost on reboot, this last-entry file will contain the content after the reboot.
The most viable and direct alternative is to obtain these changes from the generated alerts themselves, either from the alerts.json file, the alerts.log file, or from the Wazuh dashboard UI itself if you have it accessible.
