
Mon Sep 27 22:13:55 PDT 1999

o	emergency hack to get lazarus to work (something always breaks...).
	Changed lazarus.cf and coroner.cf.

o	make command not so verbose... if ($verbose) rather than defined.

-----------------------------

Mon Sep 27 20:51:41 EDT 1999

o       Don't pass zero-length arguments to crontabs that do not
	require a -u option. Some crontabs barf on that.

-----------------------------

Mon Sep 27 19:23:16 EDT 1999

o	Create the user_vault before trying to fill it.

o	Somehow the code for procfs detection didn't make it into
	coroner.cf.

o	Procfs detection code in tree.pl used the wrong variable.

o	Before using procfs, verify that it is actually mounted.

-----------------------------

Mon Sep 27 15:07:09 PDT 1999

o	added pretty date to cp/proc output files in proc.pl.

-----------------------------

Mon Sep 27 17:28:42 EDT 1999

o	Fix df being called with void argument.

o	Do not require lib/major_minor.pl, eval bin/major_minor instead.

o	Make sure eval is followed by something or some Perls optimize
	it away.

o       Use raw disk device when grave-robbing with ils/icat, some
	systems return EBUSY when opening the block device.

-----------------------------

Mon Sep 27 11:43:00 PDT 1999

o	ps_spy - all icat'ing now appends date to filename

o	added major_minor in paths, changed grave-robber to call it,
	added sub in maj_min_walk.pl.

o	maj_min_walk now follows symlinks, also keeps track of types
	of /dev's

-----------------------------

Mon Sep 27 12:02:01 EDT 1999

o	PERL local variables arent. What a #$#$@^ language (says Wietse).
	This screwed up the pid value when pcatting/icatting a process.

-----------------------------

Mon Sep 27 10:57:22 EDT 1999

o	Do not record bogus major/minor device numbers for regular files.
	The can collide with real devices.

o	Sign pcat and icat output.

o	Don't prepend the date to icat output.

o	Added lsmod+modinfo+modstat to reconfig+paths.pl+lib/hostinfo.pl.

o	Added netstat -na.

o	More .ssh files to be captured.

o	Create data/host/trust (coroner.cf).

-----------------------------

Sun Sep 26 18:12:20 PDT 1999

o	trust.pl & coroner.cf updated, now trust stuff goes into trust subdir

o	ps_spy.pl - bug fixed WRT making $DELETED_FILES dir

o	new module, lib/proc.pl, handles copying of proc stuff, coroner.cf
	changed to say where /proc files get copied to, grave-robber updated
	as well.

-----------------------------

Sun Sep 26 21:09:52 EDT 1999

o	fixed reconfig again so it will handle whitespace around "=".

-----------------------------

Sun Sep 26 13:05:09 PDT 1999

o	(Note - adding scaffolding as I go along, testing).

o	trust.pl - new functionality added, grabs user files found in 
	coroner.cf (including some ssh, pgp, etc.)

o	-q flag added to grave-robber, changed man & docs

o	suck_proc_icat added to grave-robber, also moved around the
	dev walker so that it's before this (required to get maj/min).

o	ps_spy.pl now saves icat'd files

o	icat'd files now go to two places - $DELETED_FILES & $ICAT_OUT

o	maj_min_walk changed to keep global DB of maj/min #s, put in
	scaffolding

-----------------------------

Sat Sep 25 21:48:34 EDT 1999

o	Added "last", removed "lastcomm" in list of commands in reconfig.

o	Added "typescript" to list of files to be cleaned up.

-----------------------------

Sat Sep 25 14:57:30 PDT 1999

o	more changes to BUGS

o	changed -p option to mean *run* the pcat sucker, reverse of
	what it was.  Man page & quick-start fixed.

o	changed quick-start

o	gave coroner.cf, tree.pl, and maj_min_walk.pl an option
	to not follow/process symlinks.

-----------------------------

Sat Sep 25 14:57:30 PDT 1999

o	solaris - is the strings(1) command just broken, or is it me?
	od -s doesn't exist, either... blech.

o	coroner.cf - command_to_string fix...

o	$TCT-HOME/test.pl - nuked

o	added/edited text in docs/grave-robber.README & BUGS

o	added $AT to paths.pl

-----------------------------

Sat Sep 25 17:41:31 EDT 1999

o	grave-robber redirects STDIN to /dev/null to make child processes
	more robust. The format command needs this so don't take it away.

o	Added a command_to_string() function for easier `command` emulation.

o	Added execute_command() function to make system() emulation easier.

o	Fixed a couple command strings that weren't broken at whitespace.

-----------------------------

Sat Sep 25 10:12:59 PDT 1999

o	hostinfo.pl - added "format < /dev/null"

o	coroner.cf and various lib files - changed to use command_to_list()

-----------------------------

Sat Sep 25 10:12:59 PDT 1999

o	added -v flag to grave-robber example in quick-start

o	fixed small bug (netstat flag) in netinfo.pl

o	added some text to the BUGS file

-----------------------------

Sat Sep 25 01:14:51 PDT 1999

o	installed your md5.c & command.pl

o	changed all (that I could find) systems, open(..., "|"), etc.
	to safe execs.

o	added domainname to paths.pl

o	added require in coroner.cf

-----------------------------

Fri Sep 24 11:22:53 PDT 1999

o	lib/crunch.pl now uses quotemeta() to protect filenames.
	Seems to kill the shell cruft.

o	added -p option to grave robber (don't suck in pcat stuff);
	also changed corresponding man page.  Changed quick-start
	& README also to discuss this.

o	relative symlink in data dir created in coroner.cf, not absolute.

o	fixed bug - no debug output - in grave-robber & coroner.cf,
	changed man page to grave-robber as well.

o	changed reconfig - nuked 'bin/ostype.pl'

o	removed the "disks.pl" & results.pl files from lib

o	added verbose option (-v) to grave-robber, changed many files
	in lib to add a bit of chattiness.

-----------------------------

Fri Sep 24 14:43:52 EDT 1999
  
o	docs/grave-robber.README: Changed "files that were running
	but deleted when grave-robber ran" to "deleted files that
	were still open or running when the grave robber ran".

-----------------------------

Fri Sep 24 09:42:28 PDT 1999

o	Moved changes to reverse chron order, so that you can instantly
	see what happened last.

o	lib/ps_spy.pl - changed two "&get_date"'s to &get_date()'s.

o	fixed two bugs in lib/date.pl

o	moved ostype.pl to lib (somehow turned up missing), changed 
	grave-robber & trust.pl to reflect this.

o	Added some stuff to docs/README (including pgp stuff), added new 
	section to docs/grave-robber.README, further explaining the data 
	directory.

o	fixed bug in misc.pl; final MD5 wasn't working.

o	INSTALL changed - now use `pwd` instead of dir

-----------------------------

Fri Sep 24 10:28:40 EDT 1999

o       Makefile: added a command "chmod 700 .". It's a system
	in production that needs to be protected.  Shipping mode
	0700 source code stinks.

o       Polished lastcomm.1, icat.1, unrm.1.

o       Ran "make manpages" because file time stamps were messed up.

o	MANIFEST: Fixed command descriptions of icat, md5, pcat. 

o	README.FIRST: "IBM free source" -> "IBM open source".

o	quick-start: "remove all the output" -> "remove all your output".

o	lazarus.1: A "." represents <insert: unrecognized> binary data.

o       docs/README: "Run it on the root file system if space
	permits" -> "Point it at the root directory if space permits.
	"keep this safely off-line" -> keep the MD5 output off-line".

o       lazarus.README: non-portable tr(1) command: "tr '\0' ''"
	should be "tr -d '\0'".

-----------------------------

Fri Sep 24 00:06:48 PDT 1999

o	TODO list modified with various todo's, TODO.before-release deleted.

o	LICENSE-IBM mv'd to LICENSE, docs changed accordingly.

o	unpacked lastcomm.tar, your changes installed

o	Makefile - deleted the "rm -rf bin" in "make tidy".  Added
	"rm -rf data".  Also chmod 755 to dirs changed to 700.

o	INSTALL & quick-start - mention lsof now as strongly suggested.

o	conf/paths.pl - added find

o	grave-robber - moved &close_config_vault() to the end, added
	comment; now it does an md5 of all data.

o	lib/misc.pl - close_config_vault() now does an md5 on all data
	(after grave-robber run).  docs/README & documents this and 
	advises you to protect it.

o	docs/README & quick-start now advise you to save your resulting 
	data offline.

o	In INSTALL clarified a sentence talking about redhat/linux and
	what we tested on (only redhat).

o	Changed coroner.cf to the full, releasable pattern (to suck up
	files) and to do md5's on all files we lstat.  Also 
	save_these_files & look@first changed to full blown version.

o	&suck_proc uncommented in grave-robber; this is the thing that
	grabs all processes with pcat.  I currently feel that it
	*probably* won't cause problems but might... so I vote to turn 
	it on.  We can easily turn it off for release, of course, just
	my current thought.

o	changed reconfig to read "Hmm" instead of "Yipes" as to less
	alarm people when a non-essential binary is not found ;-)

