onconfig file

The system administrator at my current site thought he would be very clever and he linked the onconfig files to different directories using ln -s. We have now discovered that these links are being lost when we use onmonitor and replaced by a local file, but not when we use vi. Is this yet another reason why we should not use onmonitor? Does anybody else think that onmonitor still has a role in teaching IDS to prospective admins? It is still documented in the manuals so presumably it should still work. regards Malcolm P.S. I am having to use google groups to post messages as info security here has to be seen to be believed.