Getting this information is a bit tricky. This particular way, will log information about calling bind(2) system call. This is precursory call to actually starting accepting connections (the daemon process will usually call listen and then accept after this).
This is using linux audit functionality (so it will require auditd running)
In audit.rules;
-a exit,always -F arch=b64 -S bind
Then, in audit.log we will have lines like:
type=SYSCALL msg=audit(1380535439.187:560): arch=c000003e syscall=49 success=yes exit=0 a0=8 a1=9c1ce0 a2=10 a3=7fffd8000050 items=0 ppid=3021 pid=3022 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts0 ses=4 comm="nginx" exe="/usr/sbin/nginx" key=(null)
type=SOCKADDR msg=audit(1380535439.187:560): saddr=02001F90000000000000000000000000
The first line (type=SYSCALL syscall=49) refers to bind call (as in /usr/include/asm/unistd_64.h
, the next (type=SOCKADDR) one actually decodes/displays argument to it:
0200 1F90 00000000 0000000000000000
- first, address family (2 bytes) (in native order) (02 is AF_INET)
- next, port number (2 bytes) (in network order) (0x1f90 = 8080)
- afterwards, ip address (4 bytes) (in network order as well) (0.0.0.0 means listen on all interfaces)
- rest is irrelevant (padding)
So, what is left is to write a script which tails this file and decodes/sends notifications when matching event happened.