This is Info file xlogmaster.info, produced by Makeinfo version 1.67
from the input file tutorial.texinfo.

   This file documents the Xlogmaster

   Copyright 1998 Georg C. F. Greve <greve@gnu.org>

   Permission is granted to make and distribute verbatim copies of this
manual provided the copyright notice and this permission notice are
preserved on all copies.

   Permission is granted to copy and distribute modified versions of
this manual under the conditions for verbatim copying, provided also
that the sections entitled "Copying" and "GNU General Public License"
are included exactly as in the original, and provided that the entire
resulting derived work is distributed under the terms of a permission
notice identical to this one.

   Permission is granted to copy and distribute translations of this
manual into another language, under the above conditions for modified
versions, except that this permission notice may be stated in a
translation approved by Georg C. F. Greve.

   The Xlogmaster is a GNU program.

   Free Software Foundation, Inc.,
59 Temple Place - Suite 330, Boston, MA  02111,  USA


File: xlogmaster.info,  Node: Top,  Next: Copying,  Prev: (dir),  Up: (dir)

Xlogmaster
**********

   The Xlogmaster is a program to monitor system activity (logfiles) &
hardware status (devices) and take actions if neccessary.

   This is edition 0.5, for the Xlogmaster version 1.4.2

* Menu:

* Copying::                     Your rights and freedoms.

* Introduction::                Introduction into the Xlogmaster

* Runtime Commands::            How to use the Xlogmaster

* Xlogmaster Concepts::         Internal Xlogmaster workings

* Configuration Files::         The file formats used for configuration

* Concept Index::               Concept Index


File: xlogmaster.info,  Node: Copying,  Next: Introduction,  Prev: Top,  Up: Top

Copying
*******

   The Xlogmaster is a GTK+ based program to monitor
system activity (logfiles) & hardware status (devices) and take actions
if neccessary.

   Copyright (C) 1998 Georg C. F. Greve

   The Xlogmaster is a GNU program.

   This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or (at
your option) any later version.

   This program is distributed in the hope that it will be useful, but
WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
General Public License for more details.

   You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software Foundation,
Inc.,  Temple Place, Suite 330, Boston, MA  02111-1307  USA


File: xlogmaster.info,  Node: Introduction,  Next: Runtime Commands,  Prev: Copying,  Up: Top

Introduction into the Xlogmaster
********************************

   Hint for people that are too impatient to read the full documentation
(as I usually am):

   RIGHT MOUSE BUTTON IN TEXT WINDOW BRINGS UP MENU

   MIDDLE MOUSE BUTTON IN TEXT WINDOW HIDES/SHOWS BUTTONS

   The first version of the Xlogmaster has been written in 1996, using
the XVIEW toolkit. I didn't like that toolkit too much so it all ended
up in a pretty messy piece of code that was only compile-time
configurable and not very stable -- I did use it for two years, though,
always telling myself "I'll be writing a clean version soon".

   June 1998 I finally managed to actually keep this promise and
completely rewrote the Xlogmaster for the GTK+ toolkit (see
`http://www.gtk.org/'). First I only intended to write it for my
private usage but when I got a lot of feedback from people around the
world I decided to make the Xlogmaster a real and regular project. With
version 1.4.0 the Xlogmaster then became an official GNU program.

   The Xlogmaster will allow you to monitor all your logfiles and all
devices that allow being read by `cat'. Furthermore it supplies several
filters that will do things from raising/hiding lines in the text
display to starting programs to send you a paging message about a
possible security breach.

   If used wisely the Xlogmaster can make it very easy to keep track of
everything that happens on your system and it can increase your systems
security by quite a lot. This program has been written and published in
the hope that it will prove useful to you but I do * not guarantee for
anything* but my best will.


File: xlogmaster.info,  Node: Runtime Commands,  Next: Xlogmaster Concepts,  Prev: Introduction,  Up: Top

How to use the Xlogmaster
*************************

   The Xlogmaster runtime usage is basically pretty simple. There is a
button on the side for each entry and as you might have guessed clicking
on the button will make the Xlogmaster display that entry.

   There are more functions that are less obvious:


     `right mouse button' will bring up the menu.
     
     `middle mouse button' will toggle whether the buttons are being
     shown/hidden.
     
     `left mouse button' will pick the standard selection (for
     cut&paste).

   these do only work in the *text window*, though.

   Apart from that you can use the cursor-keys to move the standard
selection around and activate it by hitting <RET>.

   The configuration should be self explanatory, if you keep the mouse
pointer over an object a small help window will pop up.


File: xlogmaster.info,  Node: Xlogmaster Concepts,  Next: Configuration Files,  Prev: Runtime Commands,  Up: Top

Internal workings of the Xlogmaster
***********************************

   The two concepts you should definitely know about within the
Xlogmaster are

* Menu:

* Modes::                       Description of the main modes
* Filters::                     Information about the filters
* Audio Support::               Audio Support for *Class 1* filters


File: xlogmaster.info,  Node: Modes,  Next: Filters,  Prev: Xlogmaster Concepts,  Up: Xlogmaster Concepts

Modes
=====

   The Xlogmaster knows basically two modes of operation, the *tail
mode* and the *cat mode*. Both modes are named after the programs they
emulate.

   For both modes you can give an interval -- this is the time (in 1/10
seconds) between two calls of the interrupt function. This interval
directly  determines how often the Xlogmaster checks for changes in the
logfile (*tail mode*) or how often it replaces the data in the buffer
with the current data (*cat mode*).

* Menu:

* Tail mode::                   Details about the Tail mode
* Cat mode::                    Details about the Cat mode


File: xlogmaster.info,  Node: Tail mode,  Next: Cat mode,  Prev: Modes,  Up: Modes

Tail mode
---------

   The *tail* mode basically works like using `tail -f' on a logfile.
It will read a file and then keep on reading whatever gets appended to
it over time. The Xlogmaster should also be able to catch logfile
rotations so you don't have to reopen it every time the logfiles have
been rotated.


File: xlogmaster.info,  Node: Cat mode,  Prev: Tail mode,  Up: Modes

Cat mode
--------

   The *cat* mode works like doing a `cat <filename>' so it reads the
whole file every time. This is neccessary for reading things like the
`/proc' devices.


File: xlogmaster.info,  Node: Filters,  Next: Audio Support,  Prev: Modes,  Up: Xlogmaster Concepts

Filters
=======

   The Xlogmaster has two classes of filters, enumerated *Class 0* and
*Class 1* filters. The main difference is that the *Class 0* filters
are filters being applied at *display time* while the *Class 1* filters
are being applied at *read-time*.
Matching for the filters is *always* done per line -- patterns that
would match more than one line will *never* match anything !

   The following filters are known:

* Menu:

* Class 0 filters::             Details about the Class 0 filters
* Class 1 filters::             Details about the Class 1 filters


File: xlogmaster.info,  Node: Class 0 filters,  Next: Class 1 filters,  Prev: Filters,  Up: Filters

Class 0 filters
---------------

   As mentioned before *Class 0* filters are being applied at
*display-time* -- if a line triggered multiple filters only the one
with the highest priority is being applied !

   The filters are (from highest to lowest priority):

* Menu:

* Hide::                        Functionality of the "Hide" filter
* Raise::                       Functionality of the "Raise" filter
* Lower::                       Functionality of the "Lower" filter


File: xlogmaster.info,  Node: Hide,  Next: Raise,  Prev: Class 0 filters,  Up: Class 0 filters

Hide
....

   Lines that trigger this action will be hidden without paying
attention whether the line triggered other *Class 0* filters or not.
Lines that do trigger any of these will be displayed the usual way.


File: xlogmaster.info,  Node: Raise,  Next: Lower,  Prev: Hide,  Up: Class 0 filters

Raise
.....

   Lines that triggered this acton will be raised (highlighted) without
paying attention whether they also triggered a *Lower* action.


File: xlogmaster.info,  Node: Lower,  Prev: Raise,  Up: Class 0 filters

Lower
.....

   Lines that triggered this action will be lowered (lowlighted).


File: xlogmaster.info,  Node: Class 1 filters,  Prev: Class 0 filters,  Up: Filters

Class 1 filters
---------------

   *Class 1* filters are being applied at *read-time*  -- logfiles with
*Class 1* filters are being watched in the background, the filters will
do exactly the same thing regardless of whether you are just looking at
that logfile or not.

   The *Class 1* filters will be triggered for each line they can be
applied on, but each filter only once (even if the string would
theoretically match multiple times). They do *not* exclude each other,
though. Each filter that can be applied will be applied !

* Menu:

* Alert::                       Functionality of the "Alert" filter
* Execute::                     Functionality of the "Execute" filter
* Notice::                      Functionality of the "Notice" filter
* Uniconify::                   Functionality of the "Uniconify" filter


File: xlogmaster.info,  Node: Alert,  Next: Execute,  Prev: Class 1 filters,  Up: Class 1 filters

Alert
.....

   The button of the entry that triggered the alert will flash in the
*alert color* and then slowly fades back to it's normal color. The
*alert color*, the time it takes to fade back and the smoothness of the
fading can be controlled at *configure-time* as well as *runtime*.

   The purpose of this filter is to inform you of events that are of
interest right now but become less important over time -- the fading
back prevents a situation that you come back to your machine and find
all the buttons in *alert color* additionally you get an impression of
how recent the alert was if you catch it while fading back.


File: xlogmaster.info,  Node: Execute,  Next: Notice,  Prev: Alert,  Up: Class 1 filters

Execute
.......

   This filter allows you to start programs and/or scripts when a
certain string shows up. This is potentially the most powerful of the
filters. Your program gets it's information via environment variables or
via commandline. The following variables / environment variables are
known:
`%F'
`XLM_FILENAME'
     absoute path to file/device of entry.

`%H'
`XLM_HELP'
     helptext of entry.

`%L'
`XLM_LINE'
     line that actually triggered the Execute filter.

`%M'
`XLM_MODE'
     mode of entry.

`%N'
`XLM_NAME'
     name of the Logfile that triggered the Execute filter.

   A word of warning: the execute entry will only process one command
and substitute the variables accordingly. If you want to create a more
complicated setup I'd recommend to write a small shellscript. This
especially means that piping will *not* work.


File: xlogmaster.info,  Node: Notice,  Next: Uniconify,  Prev: Execute,  Up: Class 1 filters

Notice
......

   This filter has been implemented for events that are of extreme
importantce regardless of when they have been triggered. A notice box
is being popped up at the current mouse position. This notice box
contains a list with the time and date of the triggering action as well
as the name of the entry that triggered it. If you click on an entry in
this list you'll see the triggering line in the text field below the
list.
If you set `--notice-follows-mouse' at startup the notice box will move
to the current mouse position every time something new has been added.


File: xlogmaster.info,  Node: Uniconify,  Prev: Notice,  Up: Class 1 filters

Uniconify
.........

   For people who like to keep the Xlogmaster iconifed because of space
shortage. If you set this filter the Xlogmaster will uniconify
automatically when a matching line has been seen.


File: xlogmaster.info,  Node: Audio Support,  Prev: Filters,  Up: Xlogmaster Concepts

Audio Support
=============

   The Xlogmaster has Open Sound System (OSS) support. For every *Class
1* filter type (the only exception being execute) you can define a
sound that gets played whenever this filter type has been triggered.
The requirements that the sounds have to meet are simple: They need to
be playable via `cat <soundfile> > /dev/dsp'. This usually means they
should be about 8KHz and in a standard format (`Wave', `ULaw' or `SUN
audio' for instance).
Please check out the commandline options for setting of the soundfiles.
If nothing is given the Xlogmaster will use the files in
`$prefix/etc/sound'. The standard is to play back the files called
`notice', `alert' or `uniconify' -- I'd recommend to make then symbolic
links instead of actually copying the files there.


File: xlogmaster.info,  Node: Configuration Files,  Next: Concept Index,  Prev: Xlogmaster Concepts,  Up: Top

Configuration Files
*******************

* Menu:

* Configfile Introduction::     A short overview over the used formats
* Xlogmasterrc format::         The main configuration file for all entries


File: xlogmaster.info,  Node: Configfile Introduction,  Next: Xlogmasterrc format,  Prev: Configuration Files,  Up: Configuration Files

Configfile Introduction
=======================

   There are two different filetypes used for configuration by the
Xlogmaster.  One is the GTK+ special style file, the "gtkrc" file I do
not want to say too much about that one because it is documented with
the GTK+ toolkit (*note GTK+ style file: (GTK)Resource Files) and it's
format is actually pretty simple. A look at the sample files
distributed along with the Xlogmaster should already solve all
questions, so feel free to check them out and try around with them.
They allow you to control the look of the Xlogmaster any way you want
and it's definitely worth risking a look.

   The Xlogmaster internal configuration file is pure ASCII and can
hence be processed easily with any text editor although you will most
probably not need to do so because the customization menu is much nicer.


File: xlogmaster.info,  Node: Xlogmasterrc format,  Prev: Configfile Introduction,  Up: Configuration Files

Xlogmaster configuration file format
====================================

   The format is line oriented, this means every entry needs to use
exactly one line. Entries that do not follow this policy will be
ignored.
There are two kinds of entries for the configuration file, the first is
a line that contains the "mode" of the entry along with it's name and
some more information. The format for this kind of entry is

   `MODE{FILENAME,INTERVAL,BUTTONTEXT,HELPTEXT}'

   where the fields are the same as in the customization menu:
`MODE'
     The mode for the entry (See *note modes: Modes.) , either "TAIL"
     or "CAT"

`FILENAME'
     The absolute path to the file or device that the entry is for.

`INTERVAL'
     The interval (in tenth of seconds) for this entry.  (See *note
     mode descriptions: Modes.)

`BUTTONTEXT'
     The name to appear on the button for the entry.

`HELPTEXT'
     The text that should pop up when the mouse pointer has been
     pending over the button for a short while.

The second kind of entry is the one for the filters. A filter line looks
like

   `MODES{REGEX}'

   the `MODES' are a comma separated list of filter modes (only one
*Class 0* filter is allowed) and the `REGEX' is a standard regular
expression (see GNU Regex manual). The filter lines always apply to the

   Available strings for the `MODES' are
`RAISE'
     A display-time filter.  (See *note Class 0 filters::.)

`LOWER'
     A display-time filter.  (See *note Class 0 filters::.)

`HIDE'
     A display-time filter.  (See *note Class 0 filters::.)

`NOTICE'
     A background filter.  (See *note Class 1 filters::.)

`ALERT'
     A background filter.  (See *note Class 1 filters::.)

`UNICONIFY'
     A background filter.  (See *note Class 1 filters::.)

`EXECUTE'
     A background filter.  (See *note Class 1 filters::.) This filter
     requires another argument - the commandline that will be executed
     when a line matches the *REGEX*. The commandline is just appended
     in `{   }' brackets.  (See *note Execute::.)

`INVERT'
     invert sense of matching -- all non-matching lines will trigger a
     filter

`CASE_SENSITIVE'
     matching is performed case sensitive

   Here are some lines to give you an example of how a proper
xlogmasterrc file looks.

     TAIL{/var/log/messages,3,System Messages,/var/log/messages}
     RAISE{greve}
     HIDE{accesswatch}
     HIDE{faxqclean}
     HIDE{uucpcontrol}
     HIDE{touch.*/tmp/newsrun}
     TAIL{/var/log/warn,3,Warning Messages,/var/log/warn}
     TAIL{/var/adm/kernel,3,Kernel Messages,/var/adm/kernel}
     TAIL{/var/adm/debug,3,Debugging Messages,/var/adm/debug}
     RAISE,NOTICE{accesswatch}
     HIDE{newsrun}
     EXECUTE,CASE_SENSITIVE{uucpcontrol}{xlm-mail greve}


File: xlogmaster.info,  Node: Concept Index,  Prev: Configuration Files,  Up: Top

Concept Index
*************

* Menu:

* Alert filter (Class 1):                Alert.
* Audio Support:                         Audio Support.
* Cat mode:                              Cat mode.
* Class 0 filters:                       Class 0 filters.
* Class 1 filters:                       Class 1 filters.
* Configfile Introduction:               Configfile Introduction.
* Configuration Files:                   Configuration Files.
* Execute filter (Class 1):              Execute.
* Filters:                               Filters.
* Hide filter (Class 0):                 Hide.
* How to use the Xlogmaster:             Runtime Commands.
* Internal workings of the Xlogmaster:   Xlogmaster Concepts.
* Introduction into the Xlogmaster:      Introduction.
* Lower filter (Class 0):                Lower.
* Modes:                                 Modes.
* Notice filter (Class 1):               Notice.
* Raise filter (Class 0):                Raise.
* Tail mode:                             Tail mode.
* Uniconify filter (Class 1):            Uniconify.
* Xlogmaster configuration file format:  Xlogmasterrc format.
* Your rights and freedoms.:             Copying.



Tag Table:
Node: Top1118
Node: Copying1783
Node: Introduction2787
Node: Runtime Commands4511
Node: Xlogmaster Concepts5462
Node: Modes5933
Node: Tail mode6652
Node: Cat mode7051
Node: Filters7300
Node: Class 0 filters7975
Node: Hide8555
Node: Raise8866
Node: Lower9103
Node: Class 1 filters9258
Node: Alert10168
Node: Execute10899
Node: Notice11838
Node: Uniconify12515
Node: Audio Support12802
Node: Configuration Files13681
Node: Configfile Introduction13992
Node: Xlogmasterrc format14976
Node: Concept Index17839

End Tag Table
