Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'd like to be able to get an email notification whenever syslogd logs something of, say err priority or higher. Assume this is a BSD compatible syslog daemon.

  • Can this be accomplished?
  • Should I use a named pipe to a shell script?
  • What other possible solutions are there?
share|improve this question
add comment

3 Answers

up vote 3 down vote accepted

Here's a solution that uses named pipes. It is set up for Debian, but you should be able to modify it for BSD.

share|improve this answer
    
Ended up basing my solution on this so I could daemonize the emailing. Thanks for the link. –  jason Jun 26 '09 at 22:46
    
This seems too much of a hack. Why would you spend time scripting when there is stable open source apps to do that for you? (in real time too). *see my reply. –  sucuri Jun 29 '09 at 2:07
1  
Not a hack at all. It's the way this kind of thing often gets done. –  Dennis Williamson Jun 29 '09 at 3:04
add comment

You may want to look at logcheck or logwatch. Logcheck will email you hourly with log lines that don't match a set of patterns. I suspect you could probably make it do it more frequently. I don't know of any tools that do it by watching the logfiles, but I'm sure there's something out there that does it.

share|improve this answer
    
Yeah, I'd prefer not to monitor and parse log files after they are written, but just hook into the logging process so I can get instant notifications. –  jason Jun 26 '09 at 19:29
add comment

I would use OSSEC. It monitors your logs in real time and allows you to easily alert by email (or other means) when specific events are matched. Simple to use, scalable and open source.

link: http://www.ossec.net

share|improve this answer
    
This may be overkill for the application. However, the package does a lot and if there's a need then it may be a fit. –  Dennis Williamson Jun 29 '09 at 3:03
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.