1) if file modification date has changed, open file, count number of lines and close. 2) if newly-obtained line count differs from last line count, reopen file. 3) read past and ignore old lines. 4) read new lines and analyze patterns. 5) persist new file line count and mod date for next analysis.