How to perform action when given syslog message arrives on UDP port

Question

I need to perform given action when specific message (matching for example regexp) arrives at the UDP port (syslog format). How to do this (i.e. by using already avaible softwere as opposed to writing one by hand)?

Answer 1

Maybe you should have a look at rsyslog. Its syntax is much more flexible and easy than syslogd. Also is much more powerful overall.

In any case, what you want in rsyslog would be like

if ( regex ) then action

& another_action # This line could be ignored if you want only one action

Answer 2

Syslog-ng can do this with something like:

destination d_special { program("/usr/local/bin/script"); };
filter f_special { match("regex"); };
log { source (s_all); filter(f_special); destination(d_special); };

Answer 3

I guess this link to logwatch manpage will be usefull.

Answer 4

You can use OSSEC to watch the specific pattern and use the active response functionality to do do your desired action.