Cyber-Physical Systems change at runtime, so errors are very difficult to trace. The Information Flow Monitor is a tool that captures semantic dependencies between exchanged information. To do so, we use spy nodes as observing instances distributed throughout the network. The positioning of the spies is thus important to cover as many information paths as possible. In this paper, we examine guidelines to achieve high path coverage with as less as possible spies. Using an evolutionary algorithm, a machine learning technique, we develop a metaheuristic that enables us to quickly select such spy sets.