So i'm trying to make a background process that 'espeak's specific log events

Question

I'm relatively new to linux - please forgive me if the solution is simple/obvious..

I'm trying to set up a background running script that monitors a log file for certain keyword patterns with awk and tail, and then uses espeak to provide a simplified notification when these keywords appear in the log file (which uses sysklogd)

The concept is derived from this guide

This is a horrible example of what i'm trying to do:

#!/bin/bash

tail -f -n1 /var/log/example_main | awk '/example sshd/&&/session opened for user/{system("espeak \"Opening SSH session\"")}'

tail -f -n1 /var/log/example_main | awk '/example sshd/&&/session closed/{system("espeak  \"Session closed. Goodbye.\"")}''

tail -f -n1 /var/log/example_main | awk '/example sshd/&&/authentication failure/{system("espeak  \"Warning: Authentication Faliure\"")}'

tail -f -n1 /var/log/example_main | awk '/example sshd/&&/authentication failure/{system("espeak \"Authentication Failure. I have denied access.\"")}'

The first tail command by itself works perfectly; it monitors the defined log file for 'example sshd' and 'session opened for user', then uses espeak to say 'Opening SSH session'. As you would expect given the above excerpt, the bash script will not run multiple tails simultaneously (or at least it stops after this first tail command).

I guess I have a few questions: How should I set out this script? What is the best way to constantly run this script in the background - e.g init? Are there any tutorials/documentation somewhere that could help me out? Is there already something like this available that I could use?

Thanks, any help would be greatly appreciated - sorry for the long post.

Answer 1

Personally, I would attempt to set each of these up as an individual cron job. This would allow you to run it at a specific time and at specified intervals.

For example, you could type crontab -e

Then inside, have each of these tail commands listed as such:

5 * * * * tail -f -n1 /var/log/example_main | awk '/example sshd/&&/session opened for user/{system("espeak \"Opening SSH session\"")}'

That would run that one command at 5 minutes after the hour, every hour.

This was a decent guide I found: HowTo: Add Jobs To cron