Searching FIM Asset Tokens

Select the token values from: Q_AuditNotPresent, Q_AuditInImmutableStat, Q_NeverTaskRuleExists, Q_SELinuxPackagesMissing
 
Examples
Find Linux assets with this OS status where the audit service is not in the running state.
agentservice.osStatus: Q_AuditNotPresent
Find the Linux assets whit the OS status where the SELinux packages are missing.
agentservice.osStatus: Q_SELinuxPackagesMissing
Find the Linux assets with the OS status where no FIM events will be generated.
agentservice.osStatus: Q_NeverTaskRuleExists 
 
Find Linux assets with this OS status.
agentService.osStatus: "Q_AuditChannelBusy" or agentService.osStatus: "Q_AuditConfigLockError"

agentService.osStatus: Q_AuditChannelBusy   
Audit channel is busy and fimc cannot access it

Example,
The audit channel busy error will occur if dispatcher=0 and auditd is already running (and hence, consuming the kernel's audit channel)

agentService.osStatus Q_AuditConfigLockError 
Audit config is lock in environment.
Example, 
Immutable and ConfigLockError should be the same. One being used by the old fimc (<v4.0) and the new one is probably added in 5.9

 
The OS Status value can be used to detect if the audit channel is locked or busy. 
Note: This agent status may get overwritten by a later status sent to platform by agent and 
hence the audit channel related error may not remain always visible.
 
For FIM prerequisite checks failed for Linux platform, you can use the following query.
 
agentService.osStatus:`Q_AuditNotPresent` or agentService.osStatus:`Q_AuditInImmutableState` or agentService.osStatus:`Q_NeverTaskRuleExists` or agentService.osStatus:`Q_SELinuxPackagesMissing`