The syntax of the Kazimir configuration file is relatively simple. Each line or group of lines is identified by
a leading tag that provides the information about the kind of thing the line is supposed to define.
The basis of all the work to be done by Kazimir is the logs. In all of this document, the word 'log' is used to
represented a set of line in ASCII format, not necessarily a text file on a file system.
A log can be:
a text file on a filesystem
the standard output of a background process
the lines read for a TCP client socket
In fact, Kazimir is designed to manage every Unix entities that can be access through a file descriptor on which the getline PERL function 2.1 . It would
be an easy thing to modify Kazimir to make it manage another kind of logs if it fits these criteria.
Once you have the logs defined, you can search for 'Pattern' in a log. A pattern is a regular expression that can occur in a log.
When the regular expression is found in the log, the time of the detection (based on log characteristics) is kept
Patterns are combined to define events. An event is the combination of the realization of pattern in logs. This combination is both
based on boolean and chronological bases. For example, an event can be " If this pattern occurs AND this other pattern occur" or
"If one of theses patterns occur and this other one in the following 30 seconds"
Once the events are defined, you have to associate them with actions, this association is called an 'Order'. An 'Action' is basically the operation
that launches an external command.