What is InstallAnywhere (IA) Evidence?

Summary

This article describes what "IA" (InstallAnywhere) evidence is, and how to locate this evidence type on a device.

InstallAnywhere Evidence

The FlexNet Inventory Agent collects evidence of installed applications on a machine and generates an inventory .ndi file. In the .ndi file, there may be evidence that has an "Evidence" type of "IA" as depicted below.

<Package Name="IBM InfoSphere Change Data Capture Replication Engine Update (Sybase)" Evidence="IA" Version="10.2.0.0" InstallDate="20140313T122900">
    <Property Name="InstallLocation" Value="/CDC/ReplicationEngineforSybase"/>
    <Property Name="Publisher" Value="IBM Corporation"/>
</Package>

This evidence can appear in the Flexera One ITAM or FlexNet Manager Suite web UI with a type of "IA".

This type of evidence is captured from an InstallAnywhere registry file on the device. This registry file is created by application installers that are developed using InstallAnywhere.

Locating InstallAnywhere registry files

InstallAnywhere registry files are named .com.zerog.registry.xml.

These files can be found anywhere on the device's filesystem, including the following default locations.

On devices running Windows operating systems

C:\Program Files\Zero G Registry
C:\Program Files (x86)\Zero G Registry

On devices running macOS operating systems

/Library/Preferences

On systems running other Unix-like operating systems

The location of InstallAnywhere registry files may differ depending on the user who installed the application:

Details of applications installed by the root user are commonly recorded in the following file: /var/.com.zerog.registry.xml
Details of applications installed by non-root users are commonly recorded in the .com.zerog.registry.xml file in the user's home directory.

Registry files may also be found anywhere else on the filesystem, depending on how the package installer for the software in question was authored.

Identifying where InstallAnywhere evidence has been found on a device

When the FlexNet Inventory Agent's inventory gathering process finds an InstallAnywhere registry file on the filesystem, details of the path are included in the tracker.log log file generated by the process. These details are only logged by FlexNet Inventory Agent versions 2025 R1.2 (24.2) and newer.

Typical default tracker.log file locations are:

Devices running Windows operating systems: C:\Windows\ManageSoft\tracker.log
Devices running Unix-like operating systems: /var/opt/managesoft/log/tracker.log

Messages like the following in the tracker.log show path details:

[2026-07-25T16:02:11-0500 (G, 0)] {16092} The file 'E:\APPS\Sybase64B\sybuninstall\comp\iq_client_common\.com.zerog.registry.xml' has been detected as a possible package registry

Review the contents of each .com.zerog.registry.xml file listed in the logging to identify which specific file(s) contain evidence of interest.

On devices running Unix-like operating systems, a command like the following can also be used to find .com.zerog.registry.xml files and search for particular details in them:

find / -name .com.zerog.registry.xml -print0 | xargs -0 grep -H 'IBM InfoSphere Change Data Capture Replication Engine Update'

Additional diagnostics

Additional diagnostic tracing information from the inventory gathering process can be obtained by enabling the +Inventory/Tracker/Software/Files agent trace flag in the etcp.trace file. This may be necessary to do on agent versions prior to 2025 R1.2 (24.2) which did not include relevant details in logging.

Guidance on how to enable diagnostic tracing can be found here: How to enable FlexNet Manager Suite diagnostic tracing.

This style of diagnostic tracing can help to identify exactly where .com.zerog.registry.xml files have been found during a filesystem scan. Here is an example of tracing showing this:

2026-07-25 21:02:11.115Z, pid 16092, thread 11204 (Inventory/Tracker/Software/Files): TrackFile(1) RealFile [E:\APPS\Sybase64B\sybuninstall\comp\iq_client_common\.com.zerog.registry.xml] MainDirName [E:\] NameInStage [E:\]

Ignoring Application Recognition Library (ARL) rules for recognizing unwanted InstallAnywhere evidence

Generally InstallAnywhere evidence information about installed components contained within .com.zerog.registry.xml files is assumed to be trustworthy. However, some evidence may be an unreliable indicator of what is currently installed on computers, especially in environments where software components have been removed simply by deleting files from a filesystem without also taking appropriate action to remove details from .com.zerog.registry.xml files.

If this is found to be a consistent problem for particular evidence, the relevant installer evidence rule in the ARL can be marked as Ignored. This will prevent the rules from being used to recognize installations on any devices. Note that this may also result in legitimate installations associated with that evidence failing to be recognized, so apply this technique with caution. In general, it is better to implement processes to cleanly uninstall software components in a way that updates details in .com.zerog.registry.xml files appropriately.