I am using Snort for a real-time intrusion detection system (IDS), my desire is for real-time system notifications each time a new log is written to the log file. So, NotifyOSD will display a notification of the log for each log written. I understand using a patched NotifyOSD I can use
However, this will print all lines within the log file, repeatedly. I could use
rsync and write the newest line to a temporary file, which would be cleared after each
watch command ran, and with
watch delay the output of
notify-send "$temp.snort.log. Although I feel this is gratuitous, furthermore the output would still need sanitising.
Is there a better way to achieve the real-time IDS notifications with NotifyOSD, than:
#!/bin/bash watch -n1 notify-send "$temp.snort.log" truncate -s 0 "$temp.snort.log"