I am using Snort for a real-time intrusion detection system (IDS), my desire is for real-time system notifications each time a new log is written to the log file. So, NotifyOSD will display a notification of the log for each log written. I understand using a patched NotifyOSD I can use notify-send "$snort.log"
.
However, this will print all lines within the log file, repeatedly. I could use rsyslog
or rsync
and write the newest line to a temporary file, which would be cleared after each watch
command ran, and with watch
delay the output of notify-send "$temp.snort.log
. Although I feel this is gratuitous, furthermore the output would still need sanitising.
Is there a better way to achieve the real-time IDS notifications with NotifyOSD, than:
#!/bin/bash
watch -n1 notify-send "$temp.snort.log"
truncate -s 0 "$temp.snort.log"