Permission Drift

The Permission Drift check records the access permissions of selected files and folders as a baseline and reports when they change afterwards. It runs on Windows, Linux, and macOS (each as an x64 and ARM64 build) locally through the octoja agent, every 60 minutes by default.

Prerequisites

• You need the Monitoring Check Management permission.

Steps

1. Go to Devices and open the device.
2. Click the Checks tab → Add Check → Permission Drift.
3. Enter the files or folders under Paths to watch.
4. Click Add Check.

To assign the check to many devices at once, use a config package.

Settings

If you have reviewed a change and want to keep it, turn on Accept current permissions (reset baseline), save the check, wait for one run, and then turn the option off again. While it stays on, the check accepts every change without reporting it.

Results

The result lists every path with a short signature of its current permissions; missing paths are marked as missing.

• The check only inspects the listed paths themselves, not the files and subfolders inside them.
• The baseline is stored on the device and covers the whole path list. If you change the list, the check establishes a new baseline on its next run and reports OK.
• Deleting or creating a watched path also counts as a deviation.
• The baseline is a single combined value for all paths. To find out which path changed, compare the short signatures with an earlier result in the history.

What is compared

On Linux and macOS the check compares only the permission mode. A change of owner or group alone does not trigger a deviation.

See also: Set up alerts for a check