Re: syslog idea

[grue () engin umich edu (Paul Howell)]

Fred Blonder writes:
> The limitation of Tripwire in this application is that log files are
> ALWAYS (well, almost) changing, so if Tripwire raised the alarm on a
> logfile, your reaction should be: "So what?".  ;-)

I thought that tripwire would report if the log file got smaller, 
an indication that someone is removing records, yes?

At least that seems like a reasonable thing to me.

< Paul