Review monitoring procedures and implementation evidence to verify monitoring of changes to MarkLogic software libraries, related applications, and configuration files is done. If a third-party file automated tool is used, this is not a finding. To check for automated monitoring, issue the following command at a command prompt with a user that has administrative privileges: Check to see if the crond service is running for scheduling recurring tasks. If it is not running, this is a finding. > sudo systemctl status crond Check to see if ml-filechange-mon.sh is in the cron schedule, and runs frequently enough to meet System Security Plan (SSP) requirements. If the script is not scheduled to run, or does not run frequently enough to meet the SSP requirements, this is a finding. > sudo crontab -l | grep ml-filechange Check ml-filechange-mon.sh to verify email addresses have been configured to receive alerts. If no email addresses have been added, this is a finding. > grep "EMAIL_LIST" /path/to/ml-filechange-mon.sh