Index: trunk/include/samhain.h
===================================================================
--- trunk/include/samhain.h	(revision 264)
+++ trunk/include/samhain.h	(revision 265)
@@ -106,4 +106,10 @@
 #ifdef HAVE_STDINT_H
 #include <stdint.h>
+#endif
+
+#if !defined(HAVE_UINT16_T)
+#define UINT16 unsigned short
+#else
+#define UINT16 uint16_t
 #endif
 
Index: trunk/include/sh_cat.h
===================================================================
--- trunk/include/sh_cat.h	(revision 264)
+++ trunk/include/sh_cat.h	(revision 265)
@@ -168,4 +168,6 @@
  MSG_LOGMON_SUM,
  MSG_LOGMON_COR,
+ MSG_LOGMON_MARK,
+ MSG_LOGMON_BURST,
 #endif
 
Index: trunk/include/sh_error.h
===================================================================
--- trunk/include/sh_error.h	(revision 264)
+++ trunk/include/sh_error.h	(revision 265)
@@ -109,8 +109,4 @@
 void sh_error_fixup(void);
 
-/* convert a string to a numeric priority
- */ 
-int sh_error_convert_level (const char * str_s);
-
 /* only to stderr (GOOD/BAD)
  */
Index: trunk/include/sh_error_min.h
===================================================================
--- trunk/include/sh_error_min.h	(revision 264)
+++ trunk/include/sh_error_min.h	(revision 265)
@@ -25,3 +25,7 @@
 		      long errnum, unsigned long  msg_index, ...);
 
+/* convert a string to a numeric priority
+ */ 
+int sh_error_convert_level (const char * str_s);
+
 #endif
Index: trunk/include/sh_log_correlate.h
===================================================================
--- trunk/include/sh_log_correlate.h	(revision 265)
+++ trunk/include/sh_log_correlate.h	(revision 265)
@@ -0,0 +1,24 @@
+#ifndef SH_LOG_CORRELATE_H
+#define SH_LOG_CORRELATE_H
+
+/* Clean up everything.
+ */
+void sh_keep_destroy();
+
+/* Add an event 
+ */
+int sh_keep_add(sh_string * label, unsigned long delay, time_t last);
+
+/* Add an event sequence matching rule 
+ */
+int sh_keep_match_add(const char * str, const char * queue, const char * pattern);
+
+/* Delete the list of event sequence matching rules
+ */
+void sh_keep_match_del();
+
+/* Try to find correlated events
+ */
+void sh_keep_match();
+
+#endif
Index: trunk/include/sh_log_evalrule.h
===================================================================
--- trunk/include/sh_log_evalrule.h	(revision 264)
+++ trunk/include/sh_log_evalrule.h	(revision 265)
@@ -39,7 +39,21 @@
 int sh_eval_process_msg(struct sh_logrecord * record);
 
-/* Match correlated rules
- */
-void sh_keep_match();
+enum policies {
+  EVAL_REPORT,
+  EVAL_SUM
+};
+
+struct sh_qeval  /* Queue with definitions */
+{
+  sh_string       * label;
+  enum policies     policy;
+  int               severity;
+  time_t            interval;        /* if EVAL_SUM, interval   */ 
+  struct sh_qeval * next;
+};
+
+struct sh_qeval * sh_log_find_queue(const char * str);
+
+int sh_log_lookup_severity(const char * str);
 
 #endif
Index: trunk/include/sh_log_mark.h
===================================================================
--- trunk/include/sh_log_mark.h	(revision 265)
+++ trunk/include/sh_log_mark.h	(revision 265)
@@ -0,0 +1,14 @@
+#ifndef SH_LOG_MARK_H
+#define SH_LOG_MARK_H
+
+void sh_log_mark_destroy();
+
+int sh_log_mark_add (const char * label, time_t interval, const char * qlabel);
+
+void sh_log_mark_update (sh_string * label, time_t timestamp);
+
+void sh_log_mark_check();
+
+int sh_log_set_mark_severity (const char * str);
+
+#endif
Index: trunk/include/sh_log_repeat.h
===================================================================
--- trunk/include/sh_log_repeat.h	(revision 265)
+++ trunk/include/sh_log_repeat.h	(revision 265)
@@ -0,0 +1,14 @@
+#ifndef SH_LOG_REPEAT_H
+#define SH_LOG_REPEAT_H
+
+int sh_repeat_set_trigger (const char * str);
+
+int sh_repeat_set_queue (const char * str);
+
+int sh_repeat_set_cron (const char * str);
+
+int sh_repeat_message_check (const sh_string * host, 
+			     const sh_string * msg, 
+			     time_t ltime);
+
+#endif
Index: trunk/include/sh_string.h
===================================================================
--- trunk/include/sh_string.h	(revision 264)
+++ trunk/include/sh_string.h	(revision 265)
@@ -2,4 +2,5 @@
 #define SH_STRING_H
 
+#include <stdio.h>
 
 /* String definition and utility functions.
@@ -84,4 +85,10 @@
 char ** split_array_list(char *line, unsigned int * nfields, size_t * lengths);
 
+/* Same as above, but split on delimiter list (token)
+ */ 
+char ** split_array_token (char *line, 
+			   unsigned int * nfields, size_t * lengths,
+			   const char * token);
+
 /* Return a split_array_list() of a list contained in 'PREFIX\s*( list ).*'
  */
Index: trunk/include/sh_unix.h
===================================================================
--- trunk/include/sh_unix.h	(revision 264)
+++ trunk/include/sh_unix.h	(revision 265)
@@ -219,4 +219,7 @@
 void sh_unix_closeall (int fd, int except, int inchild);
 
+/* Check whether directory for pid file exists
+ */
+int sh_unix_check_piddir (char * pidpath);
 
 /* write lock for filename