I need to perform given action when specific message (matching for example regexp) arrives at the UDP port (syslog format). How to do this (i.e. by using already avaible softwere as opposed to writing one by hand)?
4 Answers
Maybe you should have a look at rsyslog. Its syntax is much more flexible and easy than syslogd. Also is much more powerful overall.
In any case, what you want in rsyslog would be like
if ( regex ) then action
& another_action # This line could be ignored if you want only one action
Syslog-ng can do this with something like:
destination d_special { program("/usr/local/bin/script"); };
filter f_special { match("regex"); };
log { source (s_all); filter(f_special); destination(d_special); };
You can use OSSEC to watch the specific pattern and use the active response functionality to do do your desired action.