Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm going to be sending syslog from my one device/server to an Ubuntu server.

On the Ubuntu server (receiving the syslog), I want it to trigger a script when specific syslog messages arrive.

Is this possible?

share|improve this question
    
"send notification" and "trigger a script" is not quite the same. Could you be more specific to what the requirements are and/or what you would like to achieve? –  gertvdijk Jan 3 '13 at 23:51
    
Oh, sorry. I'm trying to send a notification to XBMC which can be sent by executing a pre-existing shell script or sending an HTTP request to the XBMC server. –  SofaKng Jan 4 '13 at 0:36
add comment

1 Answer

Question seems to have changed a bit and targetted on scripting, rather than sending notifications. I might remove this answer later.

It seems it is quite straightforward to set up real time triggering of shell scripts based on messages passed to rsyslog. If OP rewrites his answer to contain a better picture of what he is aiming for (as already posted in comments), I am willing to provide a high quality answer here.

Not exactly sure what your requirements are, but one particular piece of software I could recommend is logcheck. This may be useful in your situation too.

Its purpose is to send mail digests on specific matched (interesting) lines. I'm assuming basic mail configuration is working (e.g. echo bla | mail -s testmail user@domain.tld works) already. It takes care of log rotations and it knows where it has left of, so don't worry about that in scripting anymore!

Extracted some of the essential steps from this tutorial:

  1. Configure basic things in /etc/logcheck/logcheck.conf:

    REPORTLEVEL="server"          # default reportlevel with pre-configured filters
    SENDMAILTO="user@domain.tld"
    
  2. Which log files to check in /etc/logcheck/logcheck.logfiles:

    /var/log/syslog
    /var/log/auth.log
    /var/log/myapp.log
    
  3. Now, to tell it to trigger on a specific line similar to

    myapp: Error: Login failed for admin123
    

    for this myapp log, this can be realized by creating a regular expression in /etc/logcheck/ignore.d.server/myapp (note server corresponding to the used REPORTLEVEL earlier on):

    ^myapp:.*
    

    Okay, this is not the most specific regex, but that's not the point.

  4. Wait emails to arrive, e.g.:

    Subject: webserver.domain.tld 2013-01-01 10:17 System Events
    
    Jan 01 09:40:59 webserver myapp: IMAP Error: Login failed for gertvdijk
    
share|improve this answer
    
Thanks! What's actually happening is that my VOIP adapter is sending Caller ID information via syslog to another PC. When I see this information, I need to execute a shell script or send an HTTP command to XBMC (media player) to display the incoming caller id. –  SofaKng Jan 4 '13 at 0:46
    
@SofaKng Okay. Well, interesting use case, but that kind of information should be part of your answer. –  gertvdijk Jan 4 '13 at 0:51
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.