Index: trunk/Makefile.in
===================================================================
--- trunk/Makefile.in	(revision 261)
+++ trunk/Makefile.in	(revision 262)
@@ -1733,3 +1733,3 @@
 sh_nmail.o: $(srcsrc)/sh_nmail.c Makefile config_xor.h $(srcinc)/samhain.h $(srcinc)/sh_pthread.h $(srcinc)/sh_mem.h $(srcinc)/sh_mail.h $(srcinc)/sh_tiger.h $(srcinc)/sh_string.h $(srcinc)/sh_utils.h $(srcinc)/sh_fifo.h $(srcinc)/sh_filter.h $(srcinc)/sh_mail_int.h $(srcinc)/zAVLTree.h 
 sh_filter.o: $(srcsrc)/sh_filter.c Makefile config_xor.h $(srcinc)/samhain.h $(srcinc)/sh_utils.h $(srcinc)/sh_mem.h $(srcinc)/sh_filter.h 
-sh_inotify.o: $(srcsrc)/sh_inotify.c Makefile config_xor.h $(srcinc)/sh_pthread.h $(srcinc)/sh_calls.h $(srcinc)/sh_inotify.h $(srcinc)/sh_mem.h $(srcinc)/slib.h $(srcinc)/sh_calls.h 
+sh_inotify.o: $(srcsrc)/sh_inotify.c Makefile config_xor.h $(srcinc)/samhain.h $(srcinc)/sh_pthread.h $(srcinc)/sh_calls.h $(srcinc)/sh_inotify.h $(srcinc)/sh_mem.h $(srcinc)/slib.h $(srcinc)/sh_calls.h 
Index: trunk/depend.dep
===================================================================
--- trunk/depend.dep	(revision 261)
+++ trunk/depend.dep	(revision 262)
@@ -77,3 +77,3 @@
 sh_nmail.o: $(srcsrc)/sh_nmail.c Makefile config_xor.h $(srcinc)/samhain.h $(srcinc)/sh_pthread.h $(srcinc)/sh_mem.h $(srcinc)/sh_mail.h $(srcinc)/sh_tiger.h $(srcinc)/sh_string.h $(srcinc)/sh_utils.h $(srcinc)/sh_fifo.h $(srcinc)/sh_filter.h $(srcinc)/sh_mail_int.h $(srcinc)/zAVLTree.h 
 sh_filter.o: $(srcsrc)/sh_filter.c Makefile config_xor.h $(srcinc)/samhain.h $(srcinc)/sh_utils.h $(srcinc)/sh_mem.h $(srcinc)/sh_filter.h 
-sh_inotify.o: $(srcsrc)/sh_inotify.c Makefile config_xor.h $(srcinc)/sh_pthread.h $(srcinc)/sh_calls.h $(srcinc)/sh_inotify.h $(srcinc)/sh_mem.h $(srcinc)/slib.h $(srcinc)/sh_calls.h 
+sh_inotify.o: $(srcsrc)/sh_inotify.c Makefile config_xor.h $(srcinc)/samhain.h $(srcinc)/sh_pthread.h $(srcinc)/sh_calls.h $(srcinc)/sh_inotify.h $(srcinc)/sh_mem.h $(srcinc)/slib.h $(srcinc)/sh_calls.h 
Index: trunk/depend.sum
===================================================================
--- trunk/depend.sum	(revision 261)
+++ trunk/depend.sum	(revision 262)
@@ -1,1 +1,1 @@
-2870675903
+2976518268
Index: trunk/docs/Changelog
===================================================================
--- trunk/docs/Changelog	(revision 261)
+++ trunk/docs/Changelog	(revision 262)
@@ -1,5 +1,7 @@
 2.6.1:
 	* use inotify to track login/logout (sh_inotify.c, sh_utmp.c)
-
+	* support event correlation in log monitoring module
+	* make sure host matching is done in a case insensitive way
+	
 2.6.0:
 	* don't use statvfs() for process checking on FreeBSD
Index: trunk/src/sh_forward.c
===================================================================
--- trunk/src/sh_forward.c	(revision 261)
+++ trunk/src/sh_forward.c	(revision 262)
@@ -1990,4 +1990,17 @@
 #include "zAVLTree.h"
 
+static char * sh_tolower (char * s)
+{
+  char * ret = s;
+  if (s)
+    {
+      for (; *s; ++s)
+	{ 
+	  *s = tolower((unsigned char) *s);
+	}
+    }
+  return ret;
+}
+
 /* Function to return the key for indexing
  * the argument 
@@ -2109,6 +2122,9 @@
 	newclt->status_arr[i] = CLT_INACTIVE;
       (void) sh_unix_time(0, newclt->timestamp[CLT_INACTIVE], TIM_MAX);
+
       /* truncate */
       sl_strlcpy(newclt->hostname,  &str[0],        sep[0]+1);
+      sh_tolower(newclt->hostname);
+
       /* truncate */
       sl_strlcpy(newclt->salt,      &str[sep[0]+1], sep[1]-sep[0]);
@@ -2613,5 +2629,7 @@
    */
   if (he != NULL && he->h_name != NULL)
-    sl_strlcpy(h_name, he->h_name, MAXHOSTNAMELEN + 1);
+    {
+      sl_strlcpy(h_name, he->h_name, MAXHOSTNAMELEN + 1);
+    }
   else
     {
@@ -2684,4 +2702,6 @@
     }
 
+  sh_tolower(h_peer);
+  sh_tolower(h_name);
 
   if ((0 == sl_strcmp(h_peer, h_name)) || (0 == sl_strcmp(h_peer_IP, h_name)))
@@ -2694,5 +2714,5 @@
       while (he->h_aliases[i] != NULL)
 	{
-	  if (0 == sl_strcmp(he->h_aliases[i], h_name))
+	  if (0 == sl_strcmp(sh_tolower(he->h_aliases[i]), h_name))
 	    {
 	      flag = 1;
@@ -2794,4 +2814,6 @@
 	} 
     }
+
+  sh_tolower(search_string);
 
   /* ----  search the register  -----
Index: trunk/src/sh_log_evalrule.c
===================================================================
--- trunk/src/sh_log_evalrule.c	(revision 261)
+++ trunk/src/sh_log_evalrule.c	(revision 262)
@@ -682,5 +682,5 @@
 
   int           qpos = 0;
-  int           rpos = 1;
+  volatile int  rpos = 1;
   unsigned long dsec = 0;
   char *        dstr = NULL;
Index: trunk/src/sh_utmp.c
===================================================================
--- trunk/src/sh_utmp.c	(revision 261)
+++ trunk/src/sh_utmp.c	(revision 262)
@@ -581,9 +581,13 @@
   int errnum = 0;
   
-  if (sh.flag.checkSum != SH_CHECK_INIT)
-    sh_inotify_wait_for_change(mode_path[1], &inotify_watch, 
-			       &errnum, ShUtmpInterval);
-
+  if ( (sh.flag.isdaemon == S_TRUE || sh.flag.loop == S_TRUE) &&
+       sh.flag.checkSum != SH_CHECK_INIT )
+    {
+      sh_inotify_wait_for_change(mode_path[1], &inotify_watch, 
+				 &errnum, ShUtmpInterval);
+    }
+  
   lastcheck  = tcurrent;
+
   if (SH_INOTIFY_ERROR(errnum))
     {
Index: trunk/test/testrun_1b.sh
===================================================================
--- trunk/test/testrun_1b.sh	(revision 261)
+++ trunk/test/testrun_1b.sh	(revision 262)
@@ -225,5 +225,5 @@
     fi
     tmp=`egrep "Checking.*(>|\")" $LOGFILE 2>/dev/null | wc -l`
-    if [ $tmp -ne 8 ]; then
+    if [ $tmp -ne 10 ]; then
 	[ -z "$verbose" ] || log_msg_fail "checking";
 	return 1