I'm going to be sending syslog from my one device/server to an Ubuntu server.

On the Ubuntu server (receiving the syslog), I want it to trigger a script when specific syslog messages arrive.

Is this possible?

  • "send notification" and "trigger a script" is not quite the same. Could you be more specific to what the requirements are and/or what you would like to achieve? – gertvdijk Jan 3 '13 at 23:51
  • Oh, sorry. I'm trying to send a notification to XBMC which can be sent by executing a pre-existing shell script or sending an HTTP request to the XBMC server. – SofaKng Jan 4 '13 at 0:36

Question seems to have changed a bit and targetted on scripting, rather than sending notifications. I might remove this answer later.

It seems it is quite straightforward to set up real time triggering of shell scripts based on messages passed to rsyslog. If OP rewrites his answer to contain a better picture of what he is aiming for (as already posted in comments), I am willing to provide a high quality answer here.

Not exactly sure what your requirements are, but one particular piece of software I could recommend is logcheck. This may be useful in your situation too.

Its purpose is to send mail digests on specific matched (interesting) lines. I'm assuming basic mail configuration is working (e.g. echo bla | mail -s testmail user@domain.tld works) already. It takes care of log rotations and it knows where it has left of, so don't worry about that in scripting anymore!

Extracted some of the essential steps from this tutorial:

  1. Configure basic things in /etc/logcheck/logcheck.conf:

    REPORTLEVEL="server"          # default reportlevel with pre-configured filters
  2. Which log files to check in /etc/logcheck/logcheck.logfiles:

  3. Now, to tell it to trigger on a specific line similar to

    myapp: Error: Login failed for admin123

    for this myapp log, this can be realized by creating a regular expression in /etc/logcheck/ignore.d.server/myapp (note server corresponding to the used REPORTLEVEL earlier on):


    Okay, this is not the most specific regex, but that's not the point.

  4. Wait emails to arrive, e.g.:

    Subject: webserver.domain.tld 2013-01-01 10:17 System Events
    Jan 01 09:40:59 webserver myapp: IMAP Error: Login failed for gertvdijk
  • Thanks! What's actually happening is that my VOIP adapter is sending Caller ID information via syslog to another PC. When I see this information, I need to execute a shell script or send an HTTP command to XBMC (media player) to display the incoming caller id. – SofaKng Jan 4 '13 at 0:46
  • @SofaKng Okay. Well, interesting use case, but that kind of information should be part of your answer. – gertvdijk Jan 4 '13 at 0:51
  • /etc/logcheck/ignore.d.server Does not tell it to trigger, it tells it to ignore. By default, you get a firehose of everything, not a whitelist. – Michael R. Hines Jun 26 at 21:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.