Display NotifyOSD notification from a log file

Question

I am using Snort for a real-time intrusion detection system (IDS), my desire is for real-time system notifications each time a new log is written to the log file. So, NotifyOSD will display a notification of the log for each log written. I understand using a patched NotifyOSD I can use notify-send "$snort.log".

However, this will print all lines within the log file, repeatedly. I could use rsyslog or rsync and write the newest line to a temporary file, which would be cleared after each watch command ran, and with watch delay the output of notify-send "$temp.snort.log. Although I feel this is gratuitous, furthermore the output would still need sanitising.

Is there a better way to achieve the real-time IDS notifications with NotifyOSD, than:

#!/bin/bash
watch -n1 notify-send "$temp.snort.log"
truncate -s 0 "$temp.snort.log"

Answer 1

You could try:

tail -f "$temp.snort.log" | xargs -d '\n' -L1 notify-send -- 

tail -f keeps the file open and prints new lines as they are added to the file. xargs then reads each line and runs notify-send on it. The -- signals end of options to notify-send, so that a line beginning with - isn't accidentally considered as an option.