This file lists caveats to the normal install instructions, some of which 
might apply to your distro. This file is a work in progress.

_Suse 9.2_

Under Suse 9.2, sshd log messages are sent to AUTH not AUTHPRIV. Consequently,
install route 2 must configure syslog with:
auth.*		|/var/run/sshd.fifo
instead of:
authpriv.*	|/var/run/sshd.fifo

and install route 1 must say:
auth.*,authpriv.           <your normal system log file>
(hopefully you can use authpriv - if not mail me)

_Mac OS X_

Have had reports that ipfw support does work. Install route 2 must not use 
a | in the syslog.conf fifo name. The quick and easy install route is to
use the OS X port of sshdfilter:
http://projects.seas.columbia.edu/sshdfilter/

_BSD_

Install route 2 must not use a | in the syslog.conf fifo name.


_CentOS 5_

Uses multi-line sshd output, which was introduced into sshdfilter 1.5.6
There are no examples so regular expressions for those multi-line messages 
have not been written.

