> This brought to mind the idea of a "syslog monitor", or a process that would > just hang out someplace and stat the various log files periodically, > using some mechanism to warn of excessive size, mysterious shrinkage, and > maybe some other warning signs. Wouldn't an append only immutable file be ideal for such things, assuming you have physical security of course. -- Bill Broadley Broadley@math.ucdavis.edu UCD Math Sys-Admin Linux is great. http://ucdmath.ucdavis.edu/~broadley PGP-ok