Change Tracking and Inventory in Azure is a feature that helps you monitor and manage changes across your Azure virtual machines (VMs). It tracks modifications in files, registry keys, software, and services on your VMs, providing visibility into what's changed and when. This tool also allows you to maintain an inventory of your VM configurations, helping you ensure consistency and compliance. By using Change Tracking and Inventory, you can quickly identify and troubleshoot issues caused by unexpected changes, improving overall system reliability and security.

In this post, we will discuss how to implement Change tracking using an Azure monitoring agent and how to generate an alert if a file or folder is modified.

Enable Change tracking and Inventory using AMA agent

Enabling change tracking and Inventory requires a log analytics workspace in the same region as the VM that you will enroll.

Enable Change Tracking Single VM or Multiple VMs by Azure portal

1. Login to Azure portal – select the VM that you want to enable change tracking; if you want, select multiple VMs
   
2. Under operations, click Change tracking
   
   
   
3. In the Change Tracking and Inventory, select Enable using AMA agent, select the correct Log Analytics workspace, and hit Enable
   
   
   
4. This will take a few minutes to enable, and you will need to wait a few hours for the data to populate.
   
   
   

Configure File/Folder change tracking

You can define to monitor folder or file changes by adding the file path into the settings.

1. In the change tracking, click Settings
   
   
   
2. Click +Add, and enter the folder path where you need to monitor. If you want all the files and folders inside a parent folder, use * with Recursion.
   
   
   

   Note – you can select upload file content; this will monitor changes within the file itself.

3. Click Add, and this will create the change tracking policy with a data collection rule to your log analytics workspace
   
   
   
4. Now, you need to wait till these newly defined folders get into the Inventory; if you make any changes before they are inventoried, those changes will not be monitored. Go to the Inventory and click the Files column to see the file inventory
   
   
   
5. Now, you can make a change and see if the change tracking will pick it up. Go to Open change and inventory center, sort the change type to – Files
   
   
   

Generate an Alert if a Folder Modified

You can create an alert when the folder is modified. This is an example of an Azure monitor Alert

1. Log in to the Azure portal – Monitor - Logs
2. You can use a query like this to see the folder changes, replace the folder path name
   

   ConfigurationChange

   | where ConfigChangeType == "Files" and FileSystemPath contains "test"

   | count

   
   
   
3. If you see a result, click +New alert rule to open a new alert wizard
   
   
   
4. File system changes are monitored every 30 minutes. You can change the granularity and evaluation frequency to more than 30 minutes. Make alert logic Greater than equal to value 1.
   
   
   
5. In Actions, select +Create action group
   
   
   
6. Select Email/SMS and provide the email address of the notification group
   
   
   
7. Click Next and Create
   
   
   
8. Provide alert rule details, and click Next to create the rule
   
   
   
9. If everything is correctly configured, you will receive an email when the files in the specified folder have changed.
   
   
   

I hope this post is helpful. 

Thanks