FIM

FIM is free, open-source software for monitoring file-system changes in the background, with builds for Linux, macOS, and Windows. It best suits teams that want endpoint file-integrity monitoring without a software fee and can manage an on-premises deployment. Its useful change history and event detail come with two practical constraints: storage grows over time, and only one listed integration can be active at once.

Overview

FIM watches files in the background, keeps historical data, and emits events when monitored files change. Automatic hashes and change analysis give administrators a way to track integrity rather than relying only on alerts. It can distinguish edits to content from changes to attributes, ownership, or permissions, making it relevant to endpoint security and auditing.

On Linux, using the Linux Audit daemon lets FIM identify the actor behind an event and the command that caused it. That context can make an alert more actionable than a bare change notice. FIM can write events locally, send them over the network, or do both. Its deployment is on-premises, and it is not agentless, so it suits organizations prepared to install and maintain monitoring software on their systems.

Key features

• Historical integrity monitoring: Automatic file hashes and change analysis help track whether monitored files have changed over time.
• Detailed change detection: FIM identifies changes to content, attributes, ownership, and permissions, covering more than file edits alone.
• Event context on Linux: With the Linux Audit daemon, events can include who made a change and which command produced it.
• Flexible event output: Events can go to a local file, over the network, or to both destinations. Documented integrations are Elasticsearch 8.x or OpenSearch 2.x and Splunk indexer 9.x; only one integration can be active at a time.
• HTTPS trust setting: The indexer endpoint's certificate trust setting defaults to false for the insecure option, a useful security default when configuring an endpoint.

Pricing

FIM is free open-source software. The FIM plan costs nothing, with no usage limits stated. There is no free trial because the software is free. This removes a licensing-cost barrier, but does not remove the work of running an on-premises deployment or managing its storage, which increases over time.

Platforms

FIM supports Linux, Windows, and macOS. Its installation guide specifies Ubuntu Xenial or later, CentOS 7 or later, Windows 7 or Windows Server 2016 or later, and macOS Big Sur or later. Minimum requirements are 1 CPU core, 128 MB of memory, and 1 GB of storage. The modest minimum resource requirements are useful for smaller deployments, though the growing storage footprint deserves ongoing attention.

Who it's for

FIM is a sound fit for administrators and security teams seeking free file-integrity monitoring across a mix of major desktop operating systems, especially where historical records and event destinations matter. Linux users can gain actor and command context through the Audit daemon. Organizations needing multiple integrations active at the same time, agentless monitoring, or a cloud deployment should look elsewhere.

Pros and cons

• Pro: Free, open-source software makes file monitoring accessible without a subscription or per-endpoint price.
• Pro: Hashing, historical data, and detection across content and metadata changes provide useful integrity coverage.
• Pro: Linux Audit daemon integration can attribute changes to a user and command.
• Con: Only one documented integration can be active at a time, limiting teams that need to route events to several platforms.
• Con: Storage use grows over time, so deployments need capacity planning.
• Con: On-premises, agent-based operation is not a fit for teams seeking agentless or cloud-native monitoring.

Alternatives

CimTrak Integrity Suite is worth considering for buyers seeking a paid option with a free trial and Linux, macOS, self-hosted, web, and Windows platform support.

OSSEC is another free-plan option with a free trial and Linux, macOS, self-hosted, and Windows support; its OSSEC plan is command-line software with core rules and no dedicated support staff.

Samhain is a free alternative with Linux, macOS, self-hosted, and Windows support.

EventSentry File Monitoring offers a free trial and a free Light plan for five machines, with basic log monitoring, community support, no SIEM capability, and no dashboards; it may suit a small deployment that fits those limits.

PA File Sight is a freemium alternative with a free trial and a perpetual endpoint plan priced at $20, paid once.

Wazuh has a free, self-hosted open-source plan and supports Linux, macOS, Windows, web, and API platforms; consider it if those deployment and platform options better fit your environment.

ManageEngine ADAudit Plus has a free edition capped at 25 workstations and supports web and Windows, making it an option where that scope and platform coverage are sufficient.

Atomic OSSEC is a paid alternative for web, Windows, macOS, and Linux.

For more options, browse File Integrity Monitoring Software.

Verdict

Choose FIM if you want free, open-source file monitoring across Linux, Windows, and macOS, with historical data and detailed change events. Its strongest case is useful integrity coverage without a licensing fee. Look elsewhere if you need several integrations active together or want to avoid an on-premises agent and the storage growth that comes with keeping history.