Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to perform given action when specific message (matching for example regexp) arrives at the UDP port (syslog format). How to do this (i.e. by using already avaible softwere as opposed to writing one by hand)?

share|improve this question
Do you really want to do it as it arrives at the UDP port? Or can it wait until the message is written to a logfile? – Stefan Lasiewski Jul 13 '10 at 22:26
up vote 2 down vote accepted

Maybe you should have a look at rsyslog. Its syntax is much more flexible and easy than syslogd. Also is much more powerful overall.

In any case, what you want in rsyslog would be like

if ( regex ) then action

& another_action # This line could be ignored if you want only one action
share|improve this answer

Syslog-ng can do this with something like:

destination d_special { program("/usr/local/bin/script"); };
filter f_special { match("regex"); };
log { source (s_all); filter(f_special); destination(d_special); };
share|improve this answer

I guess this link to logwatch manpage will be usefull.

share|improve this answer

You can use OSSEC to watch the specific pattern and use the active response functionality to do do your desired action.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.