is it possible to intercept syslog messages and evaluate (in special cases change) them before they are written into /var/log/?
At the moment i m using inotify to monitor the log file and write the evaluated log into a new file.
Yes, it is possible. You can do it with
No, I'm not going to tell you specifically how to do it, because it's a TERRIBLE idea.