1

I need to perform given action when specific message (matching for example regexp) arrives at the UDP port (syslog format). How to do this (i.e. by using already avaible softwere as opposed to writing one by hand)?

1
  • Do you really want to do it as it arrives at the UDP port? Or can it wait until the message is written to a logfile? Jul 13, 2010 at 22:26

4 Answers 4

2

Maybe you should have a look at rsyslog. Its syntax is much more flexible and easy than syslogd. Also is much more powerful overall.

In any case, what you want in rsyslog would be like

if ( regex ) then action

& another_action # This line could be ignored if you want only one action
3

Syslog-ng can do this with something like:

destination d_special { program("/usr/local/bin/script"); };
filter f_special { match("regex"); };
log { source (s_all); filter(f_special); destination(d_special); };
0

I guess this link to logwatch manpage will be usefull.

0

You can use OSSEC to watch the specific pattern and use the active response functionality to do do your desired action.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .