I'd like to be able to get an email notification whenever syslogd logs something of, say err
priority or higher. Assume this is a BSD compatible syslog daemon.
- Can this be accomplished?
- Should I use a named pipe to a shell script?
- What other possible solutions are there?
Best Answer
Since the link no longer works, I've changed it to the Internet Archive and quoted a portion of the article here:
named-pipes
later versions of syslog have support for writing to named-pipes. a named-pipe is a special type of file that implements a simple fifo stream, allowing processes to talk to each other. we'll exploit named-pipes to implement real-time messaging between syslog and our mailer. in our example, we'll take all
critical
messages written to thelocal0
facility and (in addition to logging) send them to the mail recipient,fireman@example.com
.configuring syslog to write to a named-pipe
first, create a named-pipe for critical messages, for example:
next, configure syslog to log all
critical
messages written to thelocal0
facility to this pipe. add the following statement to yoursyslog.conf
file.sending out messages
the final step is to mail out any messages that are written to the pipe. you can do this with a simple shell script. i've included an example below, let's call it
/usr/bin/syslogMailer
:daemon vs cron?
you'll notice that i've included the following line in the script:
this line specifies a one second timeout for the bash builtin,
read
. the script therefore runs to completion after processing one batch of zero or more messages. this allows you to schedule it in cron to run, say, every 5 minutes with a statement like:alternatively, if you'd like to turn this script into a log-running daemon that will sit in an endless loop and send out messages as soon as log statements arrive, remove the timeout line and surround the read statement with an while-true loop i.e.
the daemon approach is a little more efficient and sends out emails synchronously. it has the disadvantage that if your daemon terminates unexpectedly, alerts will stop until the daemon is restarted. the cron based implementation is arguably more robust in this regard. the cron approach also allows you to batch up notifications into n minute chunks. 5 minutes in our example cron file above.