# FILE\_CREATE and FILE\_DELETE EDR events in Linux

**URL:** <https://community.limacharlie.com/t/file-create-and-file-delete-edr-events-in-linux/300>\
**Category:** Feature Requests\
**Created:** [May 7, 2025, 7:46pm UTC](https://community.limacharlie.com/t/file-create-and-file-delete-edr-events-in-linux/300 "2025-05-07T19:46:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![8bitbrad](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/8bitbrad/32/49_2.png) [@8bitbrad](https://community.limacharlie.com/u/8bitbrad)\
**Post date:** [May 7, 2025, 7:46pm UTC](https://community.limacharlie.com/t/file-create-and-file-delete-edr-events-in-linux/300/1 "2025-05-07T19:46:28Z")

</div>

It would be very helpful if the Linux agent reported FILE\_CREATE and FILE\_DELETE events. The current REFERENCE: EDR EVENTS doc page shows them as unsupported.

---

<div class="post-metadata">

**Author:** ![maximelb](https://yyz1.discourse-cdn.com/flex033/user_avatar/community.limacharlie.com/maximelb/32/13_2.png) [@maximelb](https://community.limacharlie.com/u/maximelb)\
**Post date:** [May 7, 2025, 7:58pm UTC](https://community.limacharlie.com/t/file-create-and-file-delete-edr-events-in-linux/300/2 "2025-05-07T19:58:20Z")

</div>

Hello, thanks for letting us know, that’s actually a mistake, it is supported on Linux with eBPF. Will fix the doc right away.