CO-fmon.img image file

The FMON agent maintains a baseline of file names and identifiers, generated from the CO-fmon.cnf file specification, that is used to detect changes on the system. This Image file resides in the CO-fmon.img file, in the same directory as the CO-fmon.exe and CO-fmon.cnf files.

The CO-fmon.img file generates on startup and on demand, as well as at other times, described as follows:

• On startup—When you first install and execute CO-fmon.exe program, a new image file is automatically created containing all the files specified in the CO-fmon.cnf file. This action occurs only once and defers if any CO-fmon.img file already exists on the system.
• Manually, on demand—An Image file is generated whenever you click Config > Create New Image File on the BMC Defender File Integrity Monitor Audit Report adapter screen. This allows you to accept certain changes on the system (such as after a file update for the system, or after installing new software).
• On configuration change—If you upload a new configuration file to the FMON agent, a new Image file is automatically generated. (This is necessary to keep the Image File in agreement with the files listed during periodic checks of the system.)
• Auto-generation—If you select the Auto Generate Image File option to be true on the Config screen of the BMC Defender File Integrity Monitor Audit Report adapter screen, then a new Image File is generated each time a check is made on the system, after any syslog messages are sent. In this mode of operation, a syslog message is sent only once, when a change is first detected.

During normal operation, the system detects changes to managed files and sends a syslog message for each file change. This condition persists until either the list of files is restored to its original state (by adding, deleting, or installing the original file) or until a new Image file is created on the system.