@p2 that looks write, you're saying that if you modify the '/etc/passed' FIM doesn't catch it?