Here's a high level recipe.
- Configure syslogd or rsyslogd (whichever your system uses) to output
the required facility/priority messages to a named pipe in addition
to where it goes now. Extract from
This version of rsyslogd(8) has support for logging output to
named pipes (fifos). A fifo or named pipe can be used as a des‐
tination for log messages by prepending a pipe symbol ('|') to
the name of the file. This is handy for debugging. Note that the
fifo must be created with the mkfifo(1) command before rsys‐
logd(8) is started.
There is an example in my
Create a named pipe and use tail and grep to read and search from the pipe.
mkfifo /tmp/rt_monitor; tail -f /tmp/rt_monitor | grep "alert string"
You should check that system continues if named pipe becomes full if you do not have your consumer running and prevent this from occuring, I've given you a very crued recipe.