I am using Snort for a real-time intrusion detection system (IDS), my desire is for real-time system notifications each time a new log is written to the log file. So, NotifyOSD will display a notification of the log for each log written. I understand using a patched NotifyOSD I can use notify-send "$snort.log".


However, this will print all lines within the log file, repeatedly. I could use rsyslog or rsync and write the newest line to a temporary file, which would be cleared after each watch command ran, and with watch delay the output of notify-send "$temp.snort.log. Although I feel this is gratuitous, furthermore the output would still need sanitising.

Is there a better way to achieve the real-time IDS notifications with NotifyOSD, than:

watch -n1 notify-send "$temp.snort.log"
truncate -s 0 "$temp.snort.log"

You could try:

tail -f "$temp.snort.log" | xargs -d '\n' -L1 notify-send -- 

tail -f keeps the file open and prints new lines as they are added to the file. xargs then reads each line and runs notify-send on it. The -- signals end of options to notify-send, so that a line beginning with - isn't accidentally considered as an option.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.