Logsurfer 1.4
=============

This is version 1.4 of the logdaemon package (the first one that is
officially released).


General Comments:
=================

To provide one simple and generic interface to regular expressions it
was necessary to use a portable regex-library. Logsurfer uses the GNU
regex library, version 0.12. To simplify installation and to use one
"configure" for the complete package the regex.[ch] files were integrated
in the logsurfer source dir. For more information read the README file
in the regex directory.

I've tested compilation using the GNU-C-Compiler, but others should work,
too.

There is one really ugly hack for sendmail included in the code. If you use
sendmail to pass a message or a report to one or more email-addresses then
you might run into a big problem if a lot of sendmails (let's say 200) are
spawned due to some unusual activity. The result maybe that you are
running out of memory if a lot of sendmail programs are running (they take
some time to deliver the message). Therefor it is strongly recommended to
invoke sendmail in "queue-only" mode which takes the messages and put it
in the queue directory for later delivery (see "sendmail -odq"). The
advantage is a very short runtime of the sendmail process with the result
that you don't have a lot of sendmails running in parallel. The problem
with this solution is, that important mail-messages maybe delayed until
the next time sendmail flushes the queue (see "sendmail -q<value>" like
"sendmail -q30m" for queue delivery every 30 minutes). If you compile the
logsurfer with the define SENDMAIL_FLUSH (use -DSENDMAIL_FLUSH in the
CFLAGS definition in the src/Makefile) then the logsurfer will flush the
mailqueue if a) external programs were executed and b) no execution of
external programs occurred within the last 30 seconds. This is done by
executing "/usr/lib/sendmail -q" in src/exec.c. If you enable this
feature you obviously need sendmail...


Compiling:
==========

Compilation should be very easy:
  % ./configure

If you want to change the default location for the "logsurfer.conf" file
from /usr/local/etc to a different place, then type
  % ./configure --with-etcdir=/your/etc/dir

You might want to check the "Makefile" and the "config.h" file if they
need manual adjustment. Then type:
  % make

This should build one program called "logsurfer". Copy it to the final
destination on your system and install the manpages by typing
  % make install


Configuration:
==============

This is the difficult part...
The configuration file syntax and some hints can be found in the manpage of
logsurfer.conf. I would suggest to start with some small examples to
understand the syntax. For the final configuration file one possible
approach is to define some messages to be ignored, others you already know
with their associated actions and the last rule as a default to send this
message to you. Then you can improve your configuration to either ignore
or react to this new message and start again and again and again...
The last rule might by something like

    ".*" - - - 0 pipe "/usr/lib/sendmail -odq logsurfer"

This rule sends the message line to the email-address "logsurfer" (make an
alias pointing to the maintainer) if none of the other rules above this
one matches. The maintainer should decide if he want to ignore the message
or if certain actions are needed. After changing the logsurfer.conf file
a restart of the logsurfer is necessary.

Read the manpages of logsurfer and logsurfer.conf for more information.


Tools:
======

In the directory "contrib" you may find some other programs (mainly small
scripts) that might come handy while using the logsurfer.


Tested:
=======

I've only tested the package on Solaris 2.5 (SunOS 5.5) systems. On some
other systems I had no problems compiling it (but I haven't tested it on
those systems).


Acknowledgments:
=================

I would like to thank the following people for their input:

- Uwe Ellerman, Klaus-Peter Kossakowski and Stefan Kelm (all DFN-CERT) for
  their help during the development and the first planning comments.
- Wietse Venema (wietse@wzv.win.tue.nl) for the template of the disclaimer
  file.
- The various authors of the regular expression library.
- Jan Krueger (zzhikrue@rrzn-user.uni-hannover.de) for finding the most
  serious bug ("-f" not working on all systems) and some other suggestions
  like pidfile or non-ansi prototypes
- Assar (assar@pdc.kth.se) for the special inforamtion on AIX and for
  hints on buiding the package in a separate directory from the source.
- Niko Makila (Niko.Makila@csc.fi) for the ---with-etcdir improvement of
  the configure script


Feedback:
=========

Please let me know if and what kind of problems you have with this package.
Your feedback will help other people avoiding those problems.
Send your feedback to:

  ley@cert.dfn.de (Wolfgang Ley)


