When s() performs integrity scans it appends information to the report
file. This file therefore eventually grows to a large size, and the systems
manager controlling s() might want to em(rotate) the report file every once in
a while (e.g., using a program like bf(logrotate)(1), also see the upcoming
section ref(LOGROTATE)). To ensure that no log-rotation takes place
while s() is busy performing integrity scans (thus modifying the report file)
the options bf(--suspend) and tt(--resume) were implemented. Both options
require the process-ID file of currently active s() process as their argument.

For example, if a s() process was once started using the command
    COMMENT(KEEP A BLANK FOLLOWING THE BACKSLASH)
        verb(
    stealth --daemon /root/stealth/small.uds --repeat 900 \ 
                    /root/stealth/small.pol)
    then the tt(--suspend) and tt(--resume) commands for this process should
be called as:
        verb(    stealth --suspend /root/stealth/small.uds
    stealth --resume /root/stealth/small.uds)
    The s() process identified in the files provided as arguments to
the tt(--suspend) and tt(--resume) options is called the em(daemon stealth
process) below.

The tt(--suspend) option has the following effect:
    itemization(
    it() If the daemon s() process is currently processing its
policy file, performing an integrity scan, then the currently executing
policy file command is completed, whereafter further commands are ignored,
except for tt(--resume) (see below) and tt(--terminate).
    it() Any scheduled integrity scans following the tt(--suspend) command
are ignored by the daemon s() process;
    it() The daemon s() process writes a message that it is being suspended to
the report file and then processes the report file as usual.
    )
    Now that the report file is no longer modified by the daemon
s() process, log-rotation may take place. E.g., a program like
bf(logrotate)(1) allows its users to specify a command or script just before
log-rotation takes place, and `s() tt(--suspend udsfile)' could be
specified nicely in such a pre-rotation section.

The tt(--resume) option has the following effect:
    itemization(
    it() The daemon s() process resumes its activities by performing
another integrity scan. Thus, tt(--resume) implies tt(--rerun).
    it() Any scheduled integrity scans following the tt(--resume) command are
again honored by the daemon s() process.
    )
    Note that, once tt(--suspend) has been issued, all commands except
tt(--resume) and tt(--terminate) are ignored by the daemon s()
process. While suspended, the tt(--terminate) command is acknowledged as a
`emergency exit' which may or may not interfere with, e.g., an ongoing
log-rotation process. The daemon s() process should not normally be
terminated while it is in its suspended mode. The normal way to terminate a
stealth process running in the background is:
    itemization(
    it() Wait for the  daemon s() process to complete an ongoing series of
integrity scan commands;
    it() Issue the `s() tt(--terminate udsfile)' command.
    )
