If you have a question that is not covered here let me know and I'll add it.
A: See the README file, section 3.1.2.
A: Dialog is probably looking for gpm and it can't find it. Start gpm (type "/etc/init.d/gpm start") or install gpm if it's not present and try again.
A: Did you receive the test e-mail? If it worked, remember that there is a delay between the e-mails to be sent (which you can configure). Only if you waited for a while longer than this delay you have reasons to worry.
A: Short answer: TAIL. It is suitable for all systems and the recommended one for high-activity servers (with rapidly increasing log files). If you use logsend on your home pc (or have low activity servers) you can switch to the INOTIFY backend and logsend will enter a stand-by-like state until the log files are modified. And last, only if you are totally sure the watched files aren't rotated, you can choose the SIMPLE backend.
A: No. Logsend keeps an internal cache containing the lines added to the files. This cache is refreshed after the e-mail notification is sent.
A: Do it now. Configure logsend and check "Get meantime changes", then start it. You should receive them.
A: Start the configuration interface, go to "Internal settings" -> "Inotifywait options for directories" and ADD this:
A: By default, all the events are caught and sent. You can easily change this in the "Internal settings" section. Set the "Inotifywait options for directories" to catch only the modification events, by ADDING this:
-e modify -e delete -e create -e move -e move_self
Check the inotifywait manpage for a description of these events. Alternatively, if you configured manually, change the LH_INOTIFY_DIR_OPTS variable.
A: So you're using it on a high-activity server. First, consider using the TAIL backend. If you are already using it and you feel adventurous, re-configure logsend and in the "Internal settings" section, change the "Extra options for tail" to:
--sleep-interval=2 --follow=name --quiet
This will check the files once at 2 seconds (instead of once per second). If for some reason you are using the INOTIFY backend to watch directories, you should know that catching only the major events can increase the perfomance, so make sure you read the previous question in this FAQ.
A: When we talk about white spaces we refer to the user settings: a string to be searched for which contains a white space, or a file to be watched which contains a white space in its name. Logsend assigns these settings to arrays and a white space inside an element would break the field separation; since changing the $IFS is not a solution to this problem, the array mechanism will be replaced in a future release. Till then, this is what you can do to enable the white space support (or a substitute of it).
If you need white space support into the strings to be searched for you can replace the white space with a period. For example, lets's say you need to get only the lines containing "john doe". You can use as the string to be searched for "john.doe". Now, the period inside "john.doe" will match any single character, including a white space. Of course, you will also get the lines containing strings like "johnXdoe", but at least you won't loose anything (you can only get some extra lines you are not interested in). You can use as many periods as the white spaces they should substitute. This works both with "grep -e" and with "grep -E", but it doesn't work with "grep -F" (and it's quite natural to be this way).
If you need white space support into the filenames, you can symlink the file containing white spaces in its name to a file without any space. Let's say you need to watch a file named "my log file":
ln -s 'my log file' myfileAnd then tell logsend to watch "myfile".