Index: trunk/docs/FAQ.html
===================================================================
--- trunk/docs/FAQ.html	(revision 582)
+++ trunk/docs/FAQ.html	(revision 1)
@@ -31,5 +31,4 @@
 div.warnblock {
 	background: #b6c5f2; color: #000;
-        background: #ffffcc; color: #000;
 	margin: 1em; padding: 0 1em 0 1em;
 	border-width: 1px;
@@ -130,14 +129,5 @@
 <br><center><h2>Rainer Wichmann</h2></center>
 <hr>
-<div class="warnblock">
-<ul>
-  <li>If you encounter problems after installing samhain, disable daemon
-      mode and run it in the foreground with 
-      <tt>samhain --foreground [more options]</tt> for debugging.</li>
-  <li>If you have problems getting client/server mode to work, please check
-      the <a href="http://www.la-samhna.de/samhain/HOWTO-client+server-troubleshooting.html">HOWTO client+server troubleshooting</a> document.</li>
-</ul>
-</div>
-<p><i>FAQ Revised: Monday 17 September 2018 15:13:17</i></p>
+<p><i>FAQ Revised: Saturday 17 September 2005 09:10:07</i></p>
 <hr><h2>Table of Contents</h2>
 <dl>
@@ -147,19 +137,16 @@
 <li><a href="#Most frequently1">1.2. samhain exits with the message &quot;Untrusted path&quot; for config/log/pid/database files</a></li>
 <li><a href="#Most frequently2">1.3. It does not log anything / Can't stop logging to console</a></li>
-<li><a href="#Most frequently3">1.4. samhain exits with the message &quot;Record with bad version number in file signature database&quot;</a></li>
-<li><a href="#Most frequently4">1.5. Client cannot self-resolve, but nslookup works fine</a></li>
-<li><a href="#Most frequently5">1.6. Server logs hostname instead of FQDN (or vice versa)</a></li>
+<li><a href="#Most frequently3">1.4. Client cannot self-resolve, but nslookup works fine</a></li>
 </ul></dd>
 <dt><b>2. Build and install</b></dt>
 <dd><ul>
-<li><a href="#Build and install0">2.1. &quot;make&quot; loops infinitely !</a></li>
-<li><a href="#Build and install1">2.2. Why does static compiling (<code>--enable-static</code>) on Solaris fail ?</a></li>
-<li><a href="#Build and install2">2.3. Compilation fails with '/usr/bin/ld: cannot find -lnss_files'</a></li>
-<li><a href="#Build and install3">2.4. The executable is corrupted after installation</a></li>
-<li><a href="#Build and install4">2.5. --enable-xml-log has no effect</a></li>
-<li><a href="#Build and install5">2.6. ./install-sh: strip: not found (Solaris)</a></li>
-<li><a href="#Build and install6">2.7. What is sh_tiger1.s?</a></li>
-<li><a href="#Build and install7">2.8. Why does static compiling (<code>--enable-static</code>) on MaxOS X fail ?</a></li>
-<li><a href="#Build and install8">2.9. Why does compiling with MySQL fail on Solaris ?</a></li>
+<li><a href="#Build and install0">2.1. [Fedora Core] Cannot compile with --enable-khide</a></li>
+<li><a href="#Build and install1">2.2. [Fedora Core] Cannot compile with --with-kcheck</a></li>
+<li><a href="#Build and install2">2.3. &quot;make&quot; loops infinitely !</a></li>
+<li><a href="#Build and install3">2.4. Why does static compiling (<code>--enable-static</code>) on Solaris fail ?</a></li>
+<li><a href="#Build and install4">2.5. Compilation fails with '/usr/bin/ld: cannot find -lnss_files'</a></li>
+<li><a href="#Build and install5">2.6. The executable is corrupted after installation</a></li>
+<li><a href="#Build and install6">2.7. --enable-xml-log has no effect</a></li>
+<li><a href="#Build and install7">2.8. ./install-sh: strip: not found (Solaris)</a></li>
 </ul></dd>
 <dt><b>3. File checking</b></dt>
@@ -221,5 +208,4 @@
 <li><a href="#Database2">7.3. I don't want the client TIMESTAMP messages in the SQL database</a></li>
 <li><a href="#Database3">7.4. What does the log_ref field mean ?</a></li>
-<li><a href="#Database4">7.5. How can I check what is in the database ?</a></li>
 </ul></dd>
 </dl>
@@ -281,9 +267,5 @@
 is a bad idea, because samhain will open the device and write (i.e. it is
 a very inefficient method).<br><br></dd>
-<dt><b><a name="Most frequently3">1.4. samhain exits with the message &quot;Record with bad version number in file signature database&quot;</a></b></dt>
-<dd>This typically happens when the initialisation of the database has been
-done repeatedly, i.e. by using '-t init' multiple times, without (re)moving
-the previous database first before an initialisation.<br><br></dd>
-<dt><b><a name="Most frequently4">1.5. Client cannot self-resolve, but nslookup works fine</a></b></dt>
+<dt><b><a name="Most frequently3">1.4. Client cannot self-resolve, but nslookup works fine</a></b></dt>
 <dd><ul>
 <li>Nslookup is  a program to query Internet domain name servers.
@@ -336,15 +318,16 @@
         xxx.xxx.xxx.xxx myhost.mydomain.tld  myhost
 </pre></div><br><br></dd>
-<dt><b><a name="Most frequently5">1.6. Server logs hostname instead of FQDN (or vice versa)</a></b></dt>
-<dd>The default is to log the hostname only, if you want the FQDN
-then there is an option for the server configuration:
-<div class="block"><pre>
-        [Misc]
-	SetStripDomain = true / false
-</pre></div><br><br></dd>
 </dl>
 <hr><h2>2. Build and install</h2>
 <dl>
-<dt><b><a name="Build and install0">2.1. &quot;make&quot; loops infinitely !</a></b></dt>
+<dt><b><a name="Build and install0">2.1. [Fedora Core] Cannot compile with --enable-khide</a></b></dt>
+<dd>The Fedora Core kernel is patched to unconditionally deny reading
+from /dev/kmem. Compiling the stealth kernel modules is not possible
+under these circumstances.<br><br></dd>
+<dt><b><a name="Build and install1">2.2. [Fedora Core] Cannot compile with --with-kcheck</a></b></dt>
+<dd>The Fedora Core kernel is patched to unconditionally deny reading
+from /dev/kmem. Checking the kernel for the presence of rootkits is
+not possible under these circumstances.<br><br></dd>
+<dt><b><a name="Build and install2">2.3. &quot;make&quot; loops infinitely !</a></b></dt>
 <dd>This may happen (e.g. when building via NFS for multiple architectures) 
    if the relative timestamps in the source directory are
@@ -353,9 +336,9 @@
    &quot;touch * &amp;&amp; make distclean&quot; in the source directory
    to recover.<br><br></dd>
-<dt><b><a name="Build and install1">2.2. Why does static compiling (<code>--enable-static</code>) on Solaris fail ?</a></b></dt>
+<dt><b><a name="Build and install3">2.4. Why does static compiling (<code>--enable-static</code>) on Solaris fail ?</a></b></dt>
 <dd>Ingo Rogalsky has provided the following information: It isn't possible 
    to link Samhain statically with Solaris. This
    is a Solaris issue (see Sun Infodoc ID12624) and not a samhain problem.<br><br></dd>
-<dt><b><a name="Build and install2">2.3. Compilation fails with '/usr/bin/ld: cannot find -lnss_files'</a></b></dt>
+<dt><b><a name="Build and install4">2.5. Compilation fails with '/usr/bin/ld: cannot find -lnss_files'</a></b></dt>
 <dd>For Linux, this is a known problem with --enable-static if you compile
      in MySQL support. The problem is that the 
@@ -373,5 +356,5 @@
      <i>client_libs</i> variable, and remove all instances 
      of <i>-lnss_files</i> and <i>-lnss_dns</i>.<br><br></dd>
-<dt><b><a name="Build and install3">2.4. The executable is corrupted after installation</a></b></dt>
+<dt><b><a name="Build and install5">2.6. The executable is corrupted after installation</a></b></dt>
 <dd>The executable will get stripped during the installation. On
         suitable systems (i386 Linux/FreeBSD currently), additionally 
@@ -383,40 +366,11 @@
         executable, therefore trying to strip manually after installation
         will corrupt the executable.<br><br></dd>
-<dt><b><a name="Build and install4">2.5. --enable-xml-log has no effect</a></b></dt>
+<dt><b><a name="Build and install6">2.7. --enable-xml-log has no effect</a></b></dt>
 <dd>If you have compiled for stealth, you won't see much, because if
         obfuscated, then both a 'normal' and an XML logfile look,
         well ... obfuscated. Use <code>samhain -jL /path/to/logfile</code>
         to view the logfile.<br><br></dd>
-<dt><b><a name="Build and install5">2.6. ./install-sh: strip: not found (Solaris)</a></b></dt>
+<dt><b><a name="Build and install7">2.8. ./install-sh: strip: not found (Solaris)</a></b></dt>
 <dd>Install the SUNWbtool package.<br><br></dd>
-<dt><b><a name="Build and install6">2.7. What is sh_tiger1.s?</a></b></dt>
-<dd>This is a precompiled assembly file for the i386 architecture 
-generated from sh_tiger1.c using gcc 3.4.0 with the following options,
-that were found to generate the fastest code:
-<pre>
- -O1 -fno-delayed-branch -fexpensive-optimizations -fstrength-reduce 
-     -fpeephole2 -fschedule-insns2 -fregmove -frename-registers -fweb 
-     -momit-leaf-frame-pointer -funroll-loops
-</pre>
-These options were determined using 
-<a href="http://www.coyotegulch.com/products/acovea/">acovea</a> 5.1.1 
-by  Scott Robert Ladd. The file is provided as precompiled assembly 
-because different versions of gcc can have very different performance, 
-require different options to compile optimal code, and
-it would be impossible to maintain a library of optimal compile options
-for every version of gcc.<br><br></dd>
-<dt><b><a name="Build and install7">2.8. Why does static compiling (<code>--enable-static</code>) on MaxOS X fail ?</a></b></dt>
-<dd>Static linking is not supported on MacOS X, see 
-<a href="http://developer.apple.com/qa/qa2001/qa1118.html">Technical Q&A QA1118</a>. 
-This is a MacOS X issue and not a bug in samhain.<br><br></dd>
-<dt><b><a name="Build and install8">2.9. Why does compiling with MySQL fail on Solaris ?</a></b></dt>
-<dd>The reason is often the shell script 'mysql_config' that comes as part
-of MySQL. This script is intended to print appropriate compiler flags for
-compiling applications that use MySQL. Unfortunately, since Sun compiles
-MySQL with the Solaris compiler, this script outputs options for the Solaris 
-compiler (i.e. unsuitable for gcc). To solve this problem, you need to move
-this script (i.e. 'mysql_config') out of your PATH before running 
-<tt>./configure</tt> (unless of course you are using the Solaris compiler
-rather than gcc).<br><br></dd>
 </dl>
 <hr><h2>3. File checking</h2>
@@ -482,5 +436,5 @@
 as &quot;localhost&quot; to the server, thus the server 
 needs to trust the client name
-as reported by the client itself, and suppress all errors on resolving
+as reported by the client itself, and suppress all eroors on resolving
 this name to the apparent address. In the server configuration:
 
@@ -600,6 +554,5 @@
      <p>
      Alternatively, you can <code>scp</code> the database
-     to the client, run <code>samhain -t update -l none --foreground</code> 
-     (you
+     to the client, run <code>samhain -t update -l none</code> (you
      need to avoid logging because otherwise you will get in conflict with
      the running samhain daemon), and then <code>scp</code> the 
@@ -790,5 +743,5 @@
 
         2.) In your client or server configuration file, you are using
-        the option for a custom message header, but without paying attention
+        the option for a custum message header, but without paying attention
         to preserving the XML format.
 </pre></div><br><br></dd>
@@ -800,5 +753,5 @@
 
      This will enable/disable logging of the server timestamp for client
-     messages. The server timestamp will be written to a separate record,
+     messages. The server timestamp will be written to a seperate record,
      with <i>log_ref</i> set to the value of 
      <i>log_index</i> of the corresponding client message.<br><br></dd>
@@ -840,13 +793,4 @@
         number of the corresponding client message). Zero indicates a message
         by the server itself (e.g. the server's start message).<br><br></dd>
-<dt><b><a name="Database4">7.5. How can I check what is in the database ?</a></b></dt>
-<dd>Use a command line client to login to the database and query it:
-<div class="block"><pre>
-     sh$ mysql -u &lt;user_name&gt; -p &lt;database_name&gt;
-     Enter password: ****
-     mysql&gt; SELECT log_index,log_ref,log_host,log_sev,log_msg,path FROM &lt;table_name&gt; WHERE entry_status = 'NEW' ORDER BY log_index;
-     ....
-     mysql&gt; \q 
-</pre></div><br><br></dd>
 </dl>
 <hr>
