FIM with Audit works by keeping a copy of the file...
# general
a
FIM with Audit works by keeping a copy of the file descriptor map of each process