$Id: TODO,v 1.4 1999/04/21 08:17:00 lmb Exp $

Somewhat ordered by perceived importance:

- Fix remaining bugs and remove redundant code

- Local logging of incoming messages
  Will allow for logging to a specific filename, which allows for
  substitution of patterns (so you can log to "<hostname>.<facility>").
  Prefixed by time with msec resolution.

- Allow for reloading of the configuration file on the fly
  You don't really want a syslog message to get lost, and kill/restart
  syslog.monitor is not an option if it also does the logging.
  
- Fix remaining bugs and remove redundant code

- There should be a way for the patterns to match part of the syslog message
  and send it to the mon server with the trap - it should be possible to
  send the IP address of the remote host etc.
  (This should also be available later for matching again: Only alert if more
  than 100 http connects/second have been comeing in from the same host for
  example.)
  
- Find some good idea on how to deal with "Last message repeated xx times"
  statements.
  Maybe assume even distribution since the last message was received?
  Maybe patch syslogd to not do this?
  
  The same question applies to Cisco routers, which inform you that "1000
  packets have been denied", which might be somewhat more serious than "1
  packet has been denied" ... Patching a Cisco is not an option though ;-)
  
- Provide further examples for patterns

- Write documentation which does not insult the reader

- It might be neat to have the option to specify how many matches are OK in
  relation to the time of day:
  if our mailserver started to process 1000 mails per hour at 3 o'clock,
  this is definetely different than 1000 mails per hour during day time...

- Find a way to gather statistical data into a database at the same time.

- syslog.monitor should drop root privs after the syslog port has been
  successfully bound.

- Deal properly with syslog packets which contain the time at which it was 
  send (ie Ciscos do this)

- Reduce memory & CPU usage
  Precompiled patterns are already quite fast. Maybe this is a nonissue.

- Fix remaining bugs and remove redundant code
