    Short options are provided between parentheses, immediately following
their long option equivalents. 

    Option descriptions showing (C) can only be used on the command-line, and
are ignored when specified in the second section of the policy file.

    In the overview of options `tt(<uds>)' represents the name of the
em(Unix Domain Socket) to use, and `tt(<file-spec>)' refers to a (relative or
absolute) specification of a file location. 

    With the first and second synopses relative locations (of the Unix Domain
Socket and of other file-specifications) are interpreted relative to the
current working directory.

    Command-line options overrule options defined in the policy-file.

    itemization(
    it() tt(--daemon (-d) <uds>): (C) run as background (daemon)
        process. When the Stealth daemon process is started, the Unix Domain
        Socket (tt<uds>) may not already exist. 
    it() tt(--dry-run): (C) no integrity scans or reloads are performed, but
        are assumed OK. Remaining tasks are normally performed;
    it() tt(--help (-h)): (C) Display help information and exit;
    it() tt(--log (-L) <file-spec>): log messages are appended to
        `file-spec'. If file-spec does not exist, it is first created;
    it() tt(--logmail): mail sent by s() is logged (requires tt(--log) or
        tt(--syslog)); 
    it() tt(--max-size <size>[BKMG]): files retrieved by tt(GET) commands may
        at most have tt(<size>) bytes (B), KBytes (K), MBytes (M), GBytes
        (G). The default size is 10M, the default unit is B.
    it() tt(--no-mail): mail is not sent. By default mail is sent as
        configured in the policy-file (tt(--logmail) can be specified
        independently from tt(--no-mail));
    it() tt(--parse-policy-file (-p)): (C) parse the policy file, after which
        s() ends.nl()
        Specify once to see the numbered commands;nl()
        twice to see the policy file parsing steps as well.nl()
        Results are written to the std. output.
    it() tt(--ping <uds>): (C) performs no actions, but is used to verify that
        a s() daemon can be reached via its Unix Domain Socket
        (tt(<uds>)). The daemon will respond even if it's currently performing
        an integrity scan. It is used by the tt(/usr/bin/stealthcron) script
        to verify that a s() daemon is alive.
    it() tt(--random-interval (-i) <interval>[m]>): start the scan a random
        interval of <interval> seconds (or minutes if an `m' is appended (no
        blanks) to <interval>) following the delay specified at tt(--repeat)
        (see below). This option requires specification of the tt(--repeat)
        and tt(--daemon) options;
    it() tt(--reload <uds>): (C) reloads the configuration and skip-files
        and restarts the scan of the s() daemon process. Options defined in
        the policy file are also reloaded. However, command-line options
        always take priority over options defined in the policy file, so when
        command-line options were used when starting s() in daemon mode, they
        cannot be modified by reloading the policy file.
    it() tt(--repeat <seconds>): wake up and perform an integrity scan at
        interrupts or after tt(<seconds>) seconds (or minutes if an `m' is
        appended (no blanks) to <seconds>) after completing the previous
        integrity scan. The option tt(--random-interval) can be used to add a
        random delay to tt(<seconds>) until the next integrity scan is
        performed. This option requires specification of the and tt(--daemon)
        option;
    it() tt(--rerun <uds>): (C) start executing the integrity scan
        commands that are specified in the s() daemon process's policy file;
    it() tt(--resume <uds>): (C) resume a suspended s() process, implies
        tt(--rerun);
    it() tt(--run-command (-r) <nr>): (C) Only execute command number <nr>
        (natural number).  Command numbers are shown by s()
        tt(---parse-policy-file). This option can only be specified using the
        second synopsis;
    it() tt(--skip-files (-s) <file-spec>): all entries in tt(<file-spec>) are
        skipped. Their integrity is not monitored. If an entry is already
        present in a log file then s() once generates an tt(IGNORING) message
        in the mail sent to the address specified at tt(EMAIL) in the policy
        file. Each entry mentioned in tt(file-spec) must be on a line of
        its own and must be specified using absolute file paths. Entries
        ending in a slash are assumed to be directories whose full contents
        must be skipped. Other entries are interpreted as the names
        of files to skip. Initial and trailing blanks, empty lines and lines
        having a tt(#) as their 1st non blank character are ignored. Here are
        some examples:
            verb(
        # skip all files in user's Mail directory
    /home/user/Mail/
        # skip user's .history file
    /home/user/.history
            )
    it() tt(--stdout (-o)): messages are (also) written to the std. output
        stream (only available with the second synopsis);
    it() tt(--suspend <uds>): (C) suspends a currently active s()
        process. Following tt(--suspend) use tt(--resume) to re-activate an
        s() daemon or tt(--terminate) to end an s() daemon;
    it() tt(--syslog): write syslog messages;
    it() tt(--syslog-facility <facility>):  syslog facility to use. By
        default facility DAEMON is used;
    it() tt(--syslog-priority <priority>): syslog priority to use. By
        default priority NOTICE is used;
   it() tt(--syslog-tag <tag>): tt(<tag>) specifies the identifier that is
        prefixed to syslog messages. By default the tag `STEALTH' is used, see
        also the next section;
    it() tt(--terminate <uds>): (C) terminate a currently active s()
        process;
    it() tt(--time-stamp (-t) <type>): the time-stamps to use. By default
        UTC. To use the local time specify tt(--time-stamp
        LT). The tt(--time-stamp) option does not apply to time-stamps
        generated by syslog (see also the next section);
    it() tt(--usage): (C) Display help information and exit;
    it() tt(--verbosity <value>): determines the amount of logged
        information. Requires options tt(--log) or tt(--syslog). Possible
        values are:nl()
                         0: nothing is logged+nl()
                         1: (default) mode reports and policy commands+nl()
                         2: also: ipc commands and actions+nl()
                         3: also: integrity scan informative messages
    it() tt(--version (-v)): (C) Display s()'s version information and
        terminate;
    )

    itemization(
    it() tt(policy): file specification of the policy file. If a relative
        location is specified then this location is interpreted relative to
        the current working directory. S() converts this relative
        specification to an absolute file location, and an option like
        tt(--reload) will reload the policy file from the thus determined
        absolute file path.
    )

    Only one of the options tt(--daemon, --reload, --resume,
--suspend) or tt(--terminate) can be specified. The options tt(--reload,
--rerun, --resume, --suspend,) and tt(--terminate) ignore any other options.

The following options are still recognized for backward compatibility with s()
pre-3.00 versions and will be removed in a future s() version. They generate
error messages suggesting alternatives:

    itemization(
    it() tt(--echo-commands (-e)):
            echo commands to std error when they are processed; use tt(--log)
            instead.
    it() tt(--keep-alive): run as a daemon; use tt(--daemon) instead.
    it() tt(--only-stdout): scan report is written to stdout; use
        tt(--stdout) instead.
    it() tt(--quiet (-q)): suppresses progress messages written to stderr; use
        tt(--verbosity 0) instead.
    it() tt(--suppress <uds>): suppresses a currently active s()
            process; use tt(--suspend) instead.
    )

The following options were discontinued starting since s() version 3.00.00:
    itemization(
    it() tt(--debug) (option tt(--verbosity) or tt(--dry-run) could be used 
                    instead);
    it() tt(--no-child-processes);
    it() tt(--parse-config-file).
    )

When specifying long options in policy files initial hyphens should be
omitted. Here are some examples:
        verb(    %%
    log /tmp/stealth.log
    verbosity 3)







