Example of CO-fmon.cnf


CO-fmon.cnf is the central configuration file that the BMC Defender FIM Adapter service uses. An administrator or system developer can edit this file to specify the directories and parameters that the File Integrity Monitor uses.

As stated in CO-fmon-configuration-file, the configuration file does not necessarily require modification. The default configuration, which the installation utility creates, is adequate for most environments. However, if you want to create a highly customized installation, targeting specific types of event log messages, you can do so by modifying the directives in CO-fmon.cnf.

This file resides in the same directory as the CO-fmon program. The actual file depends on the particular package that is installed and varies between UNIX target systems.

The following example shows the default CO-fmon.cnf file:

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# FMON - BMC-AMI-Datastream for z/Linux
# File Integrity Monitor, Configuration File.
# ZLINUX s390x Version

# See "BMC-Datastream Unix Tool Set Reference Manual" for detailed notes.
# Copyright (c) 2009 - 2018, CorreLog, Inc. All rights reserved.
# Copyright 2018 - 2019, BMC Software, Inc. http://www.bmc.com
# All rights reserved.
# DO NOT DISCLOSE.
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
#
#
# Example command line to keep application running:
#
# nohup ./CO-fmon </dev/null > /tmp/fmon.output.log 2>&1 &
#
#
# The following two items are the only items actually required.
# They are configured manually, or by the installation procedure,
# and are not affected by remote configuration operations.

DestinationAddress  127.0.0.1
DestinationPort     514

# Parameters used for remote configuration of this process via the
# BMC-Datastream web interface. The user can comment these values out to
# disable remote configuration. The "ListenAuthMode" can take values
# 0=No Auth, 1=Source Address, 2=PassKey, 3=Address and Key. These
# values cannot be changed via remote configuration.

ListenAuthMode      0
ListenPassKey       Default
ListenPort          55515

# General Parameters

Schedule            hourly
ChangeSeverity      warning
AddSeverity         notice
DeleteSeverity      notice
AutoGenImage        True
UseChecksum         False
PollDelayMsec       10

# Prefix all messages with the computer hostname and user name.
#
MessagePrefix       z/Linux Location: %HOSTNAME% User Name: %USER% -

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# Directory Monitor parameters.

Directory           /etc
MatchPatt           .conf
MatchPatt           passwd
MatchPatt           group
MatchPatt           hosts
MatchPatt           sudo
ExclPatt            .tmp
ExclPatt            .log

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

Directory           /bin
MatchPatt           *
ExclPatt            .tmp
ExclPatt            .log

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

Directory           /usr/bin
MatchPatt           *
ExclPatt            .tmp
ExclPatt            .log

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# Up to 50 directories may be added.

# END OF FILE

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*