This file should probably be called README now.

I've currently tested a lot on OpenBSD 3.6, a bit on FreeBSD 4.10 and a little
on Debian with Linux 2.6.9 kernel. Oh, and Debian with Linux 2.4.18 since 
2.6.9 is currently shit and can't stay up under any sort of memory load.

The Makefile requires BSD make. In Debian, FreeBSD make is part of the
freebsd-buildutils package - installed as /usr/bin/freebsd-make - and it
works fine. Alternatively, the make-linux.sh script should work if you
have bash installed. Note that the Linux stuff is very poorly tested so YMMV.
I'd appreciate feedback on problems.

There is some weirdness with yacc on my Linux installation, in that it
sometimes fails the first time you build with `unexpected end of file'. It
seems to work fine if you just make again. It works all the time on OpenBSD
and FreeBSD.

To install, do:

	make

then, as root:
	
	make install

By default, the executable is put in /usr/local/sbin and the man pages in
/usr/local/man.

Create a logfmon.conf in /etc. My current logfmon.conf is included. Be careful
to escape characters that need it properly. This is my first attempt at
using lex/yacc so it may be a bit fragile, I'd appreciate feedback if so.

On OpenBSD, I add these lines to /etc/rc.local to run logfmon on startup:

	if [ -x /usr/local/sbin/logfmon -a -e /etc/logfmon.conf ]; then
        	echo -n ' logfmon';     /usr/local/sbin/logfmon
	fi

If you change the configuration, send a HUP to a running logfmon to make it
reload. Note that this will cause all log files to be reread in their
entirity. I don't find this a problem since I rotate logs quite aggressively
and my logs are not added to rapidly, but I'll probably look into fixing
it sometime later.

At the moment, the program assumes each log line has a 15 character date,
followed by a space, the hostname, another space and the message, for example:

Nov 16 11:46:34 hostname message

If this isn't the case, it almost certainly won't work properly.

If you are doing any kind of log rotation, you may occasionally see 
`No such file or directory' messages from logfmon in your logs. This happens
when logfmon sees that the file has been renamed or deleted by log rotation
and tries to reopen it before the log file has been recreated. An occasional
one or two of these is normal. If a file is renamed or deleted after logfmon
has started it tries to reopen every second until it suceeds, so if you see a 
lot (more than 5 or 10) of these messages, something is probably wrong. This
only applies when logfmon is running. If opening a file fails when logfmon is
initially started, it will report it to stderr and exit immediately.

Note that due to a limitation of kqueue on *BSD, logfmon will refuse to run
if the log files are not located on a UFS filesystem. If you really must
put your log files on something else, the Linux version should work on
*BSD too. In the Makefile, change the line:

SRCS+= event.c

to:

SRCS+= event-linux.c

Note that just setting the OS var to Linux won't work on FreeBSD due to
silliness with the pthread implementation.

Currently on my to do list are, in no particular order:

- there is quite a lot of stuff needs cleaned up
- the Linux event stuff is still a bit crap
- I'm not altogether happy with the context rules

Feedback is welcome.

Nicholas Marriott
nicm__@ntlworld.com
