I am preparing a log watch dog but my concern is tailing always would blow up in some point. Thus,
My concern is to monitor the log file always and if a pattern match occurs.
Issue some commands on ubuntu machine.
tailing always seems to be not the appropriate solution. Can you recommend some other way for it ?
The best tool I can think of for this task is syslog-ng (there are both commercial and open-source editions available).
There are a couple of ways to do handle this within syslog-ng, but the one I would suggest is to filter for the message characteristics you want, and then send the message to a destination that calls a program() to do what you need.
The syslog-ng documentation has more details on this, as well as the other capabilities you get with syslog-ng.
You should check out Logstash. It is a pipeline for your logfiles where you define one input, one (optional) filter, and one output.
The filter can be something that matches only when your pattern occurs, and then output channel to trigger a command.
logstash is a tool for managing events and logs. You can use it to collect logs, parse them, and store them for later use (like, for searching). Speaking of searching, logstash comes with a web interface for searching and drilling into all of your logs.
You should also consider Fail2Ban. While the program is focused on monitoring scripts for the purposes of banning would-be hacker and the related, it can easily be made to monitor any text log and take almost any action based on what it finds.
