FIM
What it is
FIM is free, open-source software for on-premises file-system monitoring on Linux, Windows, and macOS. It runs in the background, keeps historical file information, and emits events when monitored files change. The software creates file hashes and analyzes changes to content, attributes, ownership, and permissions. On Linux, the Audit daemon can identify who caused an event and which command produced it. Events can be written locally, sent over a network, or delivered to both destinations. Listed integrations include Elasticsearch 8.x or OpenSearch 2.x and Splunk indexer 9.x, with only one integration active at a time. Minimum requirements are one CPU core, 128 MB memory, and 1 GB storage, with storage use increasing over time. Supported systems include Ubuntu Xenial or later, CentOS 7 or later, Windows 7 or Server 2016 or later, and macOS Big Sur or later.
For and against
For
- Free open-source software
- Monitors content, attributes, ownership, and permissions
- Identifies Linux event users and commands
- Writes events locally, remotely, or both
- Supports Linux, Windows, and macOS
Against
- Only one listed integration can be active
- Storage use increases over time
- Agentless monitoring is not supported
- On-premises deployment
The verdict
FIM provides historical file monitoring, integrity checks, and event routing without a listed usage charge. Its integration limit and growing storage requirement should be planned for.
Who it suits
FIM suits teams seeking free, open-source endpoint file monitoring on supported operating systems. It is intended for on-premises deployment and security-focused monitoring.
Plans and prices
FIM
Free open-source software; no usage limits stated
Read 4 Oct 2026 · achiefs.com
On the record
- Change types
- FIM can identify changes to file content, attributes, ownership, and permissions.documentation.achiefs.com · read 4 Oct 2026
- Event destinations
- Events can be written to a local file, sent over the network, or sent to both destinations.documentation.achiefs.com · read 4 Oct 2026
- Event details
- Using the Linux Audit daemon, FIM can identify who caused an event and which command produced it.documentation.achiefs.com · read 4 Oct 2026
- Integrations
- The documentation lists Elasticsearch 8.x or OpenSearch 2.x and Splunk indexer 9.x, and says only one integration can be active at a time.documentation.achiefs.com · read 4 Oct 2026
- Integrity checks
- FIM automatically generates file hashes and analyzes file changes.achiefs.com · read 4 Oct 2026
- Open source
- The maker describes FIM as completely free open-source software.achiefs.com · read 4 Oct 2026
- Purpose
- FIM monitors file system changes in the background and keeps historical data about files.documentation.achiefs.com · read 4 Oct 2026
- Real-time alerts
- FIM emits events when monitored files change.achiefs.com · read 4 Oct 2026
- Requirements
- Minimum requirements are 1 CPU core, 128 MB memory, and 1 GB storage, with storage use increasing over time.documentation.achiefs.com · read 4 Oct 2026
- Security configuration
- The indexer endpoint's HTTPS certificate trust setting defaults to false for the insecure option.documentation.achiefs.com · read 4 Oct 2026
- Support
- Achiefs invites users to contact [email protected] and says help is free.achiefs.com · read 4 Oct 2026
- Supported systems
- The installation guide lists Ubuntu Xenial or later, CentOS 7 or later, Windows 7 or Windows Server 2016 or later, and macOS Big Sur or later.documentation.achiefs.com · read 4 Oct 2026
- Who it is for
- The maker says it aims to provide file monitoring to secure endpoints around the world.achiefs.com · read 4 Oct 2026
