> This brought to mind the idea of a "syslog monitor", or a process that would > just hang out someplace and stat the various log files periodically, > using some mechanism to warn of excessive size, mysterious shrinkage, and > maybe some other warning signs. There is a package called 'watcher' around that I've been using on and off for years. You can feed it the output of various programs and it will compare the current snapshot against the previous snapshot and let you know if any part of it has changed by a defined percentage, is over a preset amount, etc. It is pretty easy to configure and set up. We run it on a firewall to look for new processes, processes that have been running for two long, large changes in disk use,a nd some other odds and ends. You could run it against the output from 'ls -l /var/log/syslog' and do exactly what you're looking for. -David