Please review/revise/import wiki pages from my fork

[arubdesu]

Please import https://github.com/arubdesu/santa/wiki as you see fit, probably by cloning down with your creds and replacing the files locally.

I have three points that I could use help clarifying, although I know I'm hand-wave-y other places as well:

• Can the regex's be arrays that therefore evaluate sequentially, or does it have to be 'one superregex to rule them all'?
• Also about regex's, I'm assuming the code comments are telling me the truth about prepending ^ to those that don't have it
• I messed up the attempt at putting 'skip's in asl.conf, if you could please throw in your working example

I also renamed pages over there, and probably didn't set all of the links between page sections 100% correctly, but unless you made me a collaborator on the repo it seems I can't edit the wiki here.

[russellhancox]

Done. I made a few changes to match reality.

Can the regex's be arrays that therefore evaluate sequentially, or does it have to be 'one superregex to rule them all'?

No, it has to be one regex for performance reasons. Of course, you can use | and the like.

Also about regex's, I'm assuming the code comments are telling me the truth about prepending ^ to those that don't have it

The code comments are correct but all that means is that the regex anchors at the beginning of the string so it can't start matching part way through a path. This helps to avoid accidental matches and improves performance.

I also removed the notes about the regexes only applying to the root volume, as that isn't true; file changes on external volumes will be logged if they match the regex.

I messed up the attempt at putting 'skip's in asl.conf, if you could please throw in your working example

Done.

[arubdesu]

Cool! Just one thing I finally figured out: without restarting, HUP'ing syslogd is necessary to have the new config picked up. Please add that note to the bottom of https://github.com/google/santa/wiki/Configuration#logging-configuration

sudo killall -HUP syslogd

[russellhancox]

Done

[arubdesu]

Cool! I'll consider this closed until new features drop. Thanks!