Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There is this log file, which we would like to keep an eye on. Usually it does not receive any updates. But once or twice a week it gets updated and when it does we want to be notified about it.

Is there any way to routinely check (cron-job) and detect changes in such a text file and have linux send out an email about the change. It would also be great if the email would include the new lines, but we can live without the latter wish.

share|improve this question
@ewwhite's answer seems good enough - an alternate suggestion I thought of would be some solution using cron and diffing a copy of the logfile that is cached every time the cron job runs. – aaronsnoswell Aug 2 '12 at 1:30
up vote 3 down vote accepted

For a quick-and-dirty file content test system, I'd recommend using Monit and its file content service test. By default, the Monit daemon will check every 30 or 60 seconds (configurable), but it's an easy way to do what you're asking. An email notification or other action is easy to configure on top of that.

Their example:

  check file syslog with path /var/log/syslog
    ignore match 
        "^\w{3} [ :0-9]{11} [._[:alnum:]-]+ monit\[[0-9]+\]:"
    ignore match /etc/monit/ignore.regex
    if match 
        "^\w{3} [ :0-9]{11} [._[:alnum:]-]+ mrcoffee\[[0-9]+\]:"
    if match /etc/monit/active.regex then alert
share|improve this answer

If you are using Nagios, take a look at check_logfiles plugin:

Name       : check_logfiles
Arch       : x86_64
Version    : 3.4.2
Release    : 1.el5.rf
Size       : 167 k
Repo       : installed
Summary    : Logfile check  plugin for nagios
URL        :
License    : GPL
Description: check_logfiles is a plugin for Nagios which searches for patterns in logfiles. It is capable of scanning
           : multiple logfiles and their rotated ancestors in a single run.


# /usr/lib64/nagios/plugins/check_logfiles --logfile='/var/log/mysqld.log' --criticalpattern='is marked as crashed'

OK - no errors or warnings|default_lines=0 default_warnings=0 default_criticals=0 default_unknowns=0

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.