need help checking a file status

We had an 'event' earlier in the week where a file ended as zero-length, so I want to monitor it with hobbit.

Unfortunately, it is mode 600 owned by root, in a directory mode 600 owned by root.

I'd like to report this under the 'files' column, but I'd rather not do logfetch as suid rot.

Has anyone had luck using the file:command interface to use sudo?

Any other suggestions?

TIA

Tom Kauffman