Skip to content
Docs

File checksum

On this page
  1. Settings
  2. Example
  3. Good to know

The File checksum sensor checks a file on the machine of a private agent: that it exists, or that its content still matches a known hash. Use it to detect unwanted changes to configuration files, scripts or binaries, or to make sure an expected file is present.

In the wizard: Files. Requires an Enterprise plan and an Advanced private agent installed on the machine that holds the file.

Settings#

Setting Description
File path Full path of the file, as seen by the agent. It may use variables.
Check type Exist: the file must exist. Hash: its hash must match.
Hash algorithm MD5, SHA-1, SHA-256, SHA-384 or SHA-512.
Hash value The expected hash.
Up if equal On: healthy when the hash matches. Off: healthy when it differs — to be warned when a file is finally updated.

Example#

Gateway — nginx configuration: /etc/nginx/nginx.conf, SHA-256, the hash of the approved version. Any manual change opens an incident.

To compute a hash on Linux: sha256sum /etc/nginx/nginx.conf.

Good to know#

The agent reads the file with its own permissions: make sure the service account it runs as can read it. On Linux, the agent runs as the unprivileged user onagent: for a file only root can read, grant read access to that file alone with sudo setfacl -m u:onagent:r /path/to/file (see Install on Linux).