Swatch can watch a log file and notify you by instant message when something occurs.

Swatch is a perl program that is easy to install and test.

Use your package manager to install it:

apt install swatch

Once installed, it will only take a few minutes to try it out. Start by creating a test.log:

touch /var/log/test.log

Now, create a configuration file called /tmp/swatch.conf

watchfor /trouble/
exec /usr/local/bin/ "<ASTONISHED> Test log reports the following: $_" 1>/dev/null 2>&1

This tells swatch to watch for the word “trouble”, and when it finds that word, to send an instant message. We have a configuration file, and we have an empty test.log file just waiting for us to create a situation that sends a message. Start by running the swatch command:

# the next command launches swatch as a process in the background
/usr/bin/swatch --daemon --config-file=/tmp/swatch.conf --tail-file=/var/log/test.log

# now we add to our log file
echo "There is trouble in River City." >> /var/log/test.log

I receive a text message in my chatroom immediately.

You can see how useful this is. Any kind of event that you can grep on in a logfile can be detected and trigger an instant message to you immediately.

We don’t want this test instance of swatch running in the background, so let’s kill it for now:

pkill swatch

Swatch can be configured not blast you with duplicate messages.

Multiple Trigger Words

Swatch can do different things for different trigger words.

Watching Multiple Logs

How swatch watches more than one log.

Script Files

Swatch creates and abandons script files. Here is how to deal with those files.

Running Swatch as a permanent Daemon.

A configuration for swatch to run on boot.

Last modified November 7, 2020