When I make a single change by adding some text to a file that LEM-FIM is monitoring, I receive 5 different events in LEM; however, I am not sure I see a huge difference between the data that is available in those events. I am trying to think forward to how having a bunch of such events without different and useful information will be handled when trying to write rules against those events? It seems like it would make it more difficult as you would weed out what effectively becomes noise with all of those events.
I am certainly open to thoughts on this and am fully willing to accept I might be missing something; especially at the time of night that I am writing this.