A more reliable way to deal with this would be to use a tool that was built for the exact scenario you have in mind (which is to monitor a log and send emails out on newly detected patterns).
Download this tool
After unzipping it, and running it, you'll see many real life examples you can mimic. The one example you want to focus on is MODEL13, which addresses the task of sending email notifications to specific email addresses whenever a pattern is detected in one or multiple different logs.
./logrobot localhost /var/tmp/logXray autonda /var/log 60m '.*error.*_P_.*fatal.*' '.' 1 1 errchk -ndshow email=John.Blah@blah.com
In the above command, below are the parameters you have to change, as you see fit:
'.*error.*_P_.*fatal.*' - here, two patterns are being searched for in all logs in the /var/log directory
/var/log - this is the directory whose logs you want to monitor. If you wish to monitor a specific log file, replace this with the
absolute path to the log file.
- 1 - Send a warning alert if 1 entry is found in the log(s)
- 1 - Send a critical alert if 1 entry is found in the log(s)
- If warning and critical are the same, the check will alert as critical when the monitored pattern is found in the logs.
- errchk - This is the tag for this particular log check. Give this a deserving name...a name matching the type of log(s) being monitored...i.e. tomcatLogCheck
- And of course the email=. Change this to the appropriate email addresses.
This is a better option because it includes the necessary logic that ensures only new lines that are added to the monitored log(s) get scanned. It's also far more efficient. And it should also be portable.
Of course, make sure postfix is installed on the host so emails can be sent out. I may be forgetting something here, but that should be the gist of how the tool works.