6

I need to send snmp trap n number of host whenever any syslog is logged in /var/log/messages. How can I do this, can anybody give me any idea?

Timo
  • 6,202
  • 1
  • 26
  • 28
Rahul Dhobi
  • 2,037
  • 3
  • 14
  • 11
  • Depends on how complicated you're willing to go. you could look at something similar to the NAGIOS monitoring agents that can monitor and trap out when it picks something up. – Lawrence Mar 04 '14 at 12:54

3 Answers3

1

If you use (or switch to) rsyslog, you can install the omsnmp module which can send syslog messages as SNMP traps.

Flup
  • 8,017
  • 2
  • 33
  • 50
0

LogZilla has the ability to send matched events from syslog to a trap receiver. You can download a demo from http://www.logzilla.net/index.php/download

To use the trap forwarding, login as admin and browse to Menu>Admin>Server Admin>Alerts and enable "Send Alerts to SNMP Trap Manager" and also set the SNMP Community and SNMP Destination values. Once you set those, HUP the syslog-ng daemon and enjoy :-)

Clayton Dukes
  • 191
  • 2
  • 5
0

inotify(7) is a system call that can be used to alert your process when the filesystem changes. inotifyd is a wrapper around inotify(). (inotifyd is in busybox but perhaps not in other distros.)

With inotifyd you make a script that does what you want, e.g. foo.sh

#!/bin/sh
echo "inotifyd passed me event=$1 file=$2"

Then tell inotifyd to run your script whenever the syslog changes:

$ inotifyd ~/foo.sh /var/log/syslog:c
inotifyd passed me event=c file=/var/log/syslog
inotifyd passed me event=c file=/var/log/syslog
...
Robert Calhoun
  • 386
  • 1
  • 4