Index: trunk/include/sh_cat.h
===================================================================
--- trunk/include/sh_cat.h	(revision 283)
+++ trunk/include/sh_cat.h	(revision 294)
@@ -173,4 +173,10 @@
  MSG_LOGMON_MARK,
  MSG_LOGMON_BURST,
+#endif
+
+#ifdef USE_REGISTRY_CHECK
+ MSG_REG_MISS,
+ MSG_REG_NEW,
+ MSG_REG_CHANGE,
 #endif
 
Index: trunk/include/sh_extern.h
===================================================================
--- trunk/include/sh_extern.h	(revision 283)
+++ trunk/include/sh_extern.h	(revision 294)
@@ -41,4 +41,9 @@
  */
 int sh_ext_popen_init (sh_tas_t * task, char * command);
+
+/*
+ * -- Execute command, return first line of output
+ */
+int sh_ext_system (char * command);
 
 /*
Index: trunk/include/sh_files.h
===================================================================
--- trunk/include/sh_files.h	(revision 283)
+++ trunk/include/sh_files.h	(revision 294)
@@ -21,8 +21,13 @@
 #define SH_FILES_H
 
+void sh_audit_mark (char * file);
+void sh_audit_delete_all ();
+char * sh_audit_fetch (char * file, time_t time, char * result, size_t rsize);
+
 struct sh_dirent {
   char             * sh_d_name;
   struct sh_dirent * next;
 };
+
 
 /* free a directory listing
Index: trunk/include/sh_hash.h
===================================================================
--- trunk/include/sh_hash.h	(revision 283)
+++ trunk/include/sh_hash.h	(revision 294)
@@ -70,9 +70,10 @@
 /* Check whether a file is present in the database.
  */
-int sh_hash_have_it (char * newname);
+int sh_hash_have_it (const char * newname);
 
 /* Get a file if it is present in the database.
+ * If fileHash != NULL also return checksum.
  */
-int sh_hash_get_it (char * newname, file_type * tmpFile);
+int sh_hash_get_it (const char * newname, file_type * tmpFile, char * fileHash);
 
 /* Delete the database from memory.
@@ -113,4 +114,8 @@
 void sh_hash_unvisited (ShErrLevel level);
 
+/* Search for unvisited entries in the database, custom error handler.
+ */
+void sh_hash_unvisited_custom (char prefix, void(*handler)(const char * key));
+
 /* Set a file's status to 'visited'. This is required for
  * files that should be ignored, and may be present in the
@@ -135,15 +140,25 @@
 int hash_full_tree (void); 
 
-/* Insert data
+/* Insert data.
+ * 'key' -> path
+ * 'str' -> binary with size 'size'
  */
-void sh_hash_push2db (char * key, unsigned long val1, 
-		      unsigned long val2, unsigned long val3,
-		      unsigned char * str, int size);
+struct store2db {
+  UINT64 val0;
+  UINT64 val1;
+  UINT64 val2;
+  UINT64 val3;
+  char   checksum[KEY_LEN+1];
+  unsigned char * str;
+  int size;
+};
+
+void sh_hash_push2db (const char * key, struct store2db * save);
+
 
 /* Retrieve data
  */
-char * sh_hash_db2pop (char * key, unsigned long * val1, 
-		       unsigned long * val2, unsigned long * val3,
-		       int * size);
+char * sh_hash_db2pop (const char * key,  struct store2db * get);
+
 
 /* Write out database
Index: trunk/include/sh_registry.h
===================================================================
--- trunk/include/sh_registry.h	(revision 294)
+++ trunk/include/sh_registry.h	(revision 294)
@@ -0,0 +1,13 @@
+
+#ifndef SH_REGISTRY_H
+#define SH_REGISTRY_H
+
+int sh_reg_check_init(struct mod_type * arg);
+int sh_reg_check_timer(time_t tcurrent);
+int sh_reg_check_run(void);
+int sh_reg_check_reconf(void);
+int sh_reg_check_cleanup(void);
+
+extern sh_rconf sh_reg_check_table[];
+
+#endif
Index: trunk/include/sh_unix.h
===================================================================
--- trunk/include/sh_unix.h	(revision 283)
+++ trunk/include/sh_unix.h	(revision 294)
@@ -90,8 +90,13 @@
 /* use prelink     */
 #define MODI_PREL (1 << 13)
+
 /* get content     */
 #define MODI_TXT ((1 << 14)|MODI_CHK)
-
 #define MODI_TXT_ENABLED(a) (((a)&(1 << 14))!=0)
+
+/* get audit record  */
+#define MODI_AUDIT (1 << 15)
+#define MODI_AUDIT_ENABLED(a) (((a)&(1 << 15))!=0)
+
 
 #define SH_TXT_MAX 9200