up vote 5 down vote favorite
2
share [g+] share [fb]

I'd like to be able to get an email notification whenever syslogd logs something of, say err priority or higher. Assume this is a BSD compatible syslog daemon.

  • Can this be accomplished?
  • Should I use a named pipe to a shell script?
  • What other possible solutions are there?
link|improve this question
feedback

3 Answers

up vote 2 down vote accepted

Here's a solution that uses named pipes. It is set up for Debian, but you should be able to modify it for BSD.

link|improve this answer
Ended up basing my solution on this so I could daemonize the emailing. Thanks for the link. – jason Jun 26 '09 at 22:46
This seems too much of a hack. Why would you spend time scripting when there is stable open source apps to do that for you? (in real time too). *see my reply. – sucuri Jun 29 '09 at 2:07
1  
Not a hack at all. It's the way this kind of thing often gets done. – Dennis Williamson Jun 29 '09 at 3:04
feedback
up vote 3 down vote

You may want to look at logcheck or logwatch. Logcheck will email you hourly with log lines that don't match a set of patterns. I suspect you could probably make it do it more frequently. I don't know of any tools that do it by watching the logfiles, but I'm sure there's something out there that does it.

link|improve this answer
Yeah, I'd prefer not to monitor and parse log files after they are written, but just hook into the logging process so I can get instant notifications. – jason Jun 26 '09 at 19:29
feedback
up vote 1 down vote

I would use OSSEC. It monitors your logs in real time and allows you to easily alert by email (or other means) when specific events are matched. Simple to use, scalable and open source.

link: http://www.ossec.net

link|improve this answer
This may be overkill for the application. However, the package does a lot and if there's a need then it may be a fit. – Dennis Williamson Jun 29 '09 at 3:03
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.