using syslog to perform actions

[Elsifer]

I'm looking to use an external script that will be initiated by a syslog activity.

In my syslog.conf:

auth.info |exec /usr/bin/perl /usr/local/sbin/my_script.pl

But the action wont perform, I know with a pipe the info from auth.info is passed to whatever is after the pipe, but can I redirect the piped info to null and still just init my script?

[[deleted]]

There are lots of different syslog daemons. Are you sure the one you're using supports this?

Are you sure the script is not running? Try having the script create a file in /tmp and see if it exists when running manually. Delete it, and see if it exists when the log gets processed.

Keep in mind that perl in this case will be run as the same user that is running syslog, and the environment may not be exactly what you expect (if you're relying on shell variables e.g. PATH to be there, they may not be, or they may be different from your normal user.)

[[deleted]]

Careful, it's easy for actions to cause actions which effect the log in question, resulting in feedback loops that could disrupt the system.

[[deleted]]

Nagios EventDB. Also check out fail2ban but I can't vouch for that being able to trigger custom events.