be careful with FIM. We turned it on for our dev environment with moderately liberal monitoring (/etc/*) + a few select files