Better filtered mail notifications

Note: this post is not about mail filtering but about getting better notified on mail that is already filtered. I will assume you have an understanding of bash scripting and how grep works. This includes modifying paths within scripts for your own environment. This is one of those hack together one job scripts.

Background

I am a Linux Systems Administrator at Drexel University and we're primarily a RedHat shop. My work day is high in volume with communication on supporting systems. I receive anywhere from 0-100 text messages a day on my work phone (yes I keep my work phone completely separate). I receive anywhere between a few hundred to a few thousand emails every day. The text messages and some emails come from automated monitoring systems such as Icinga. The mail comes from a number of sources such as:

• cron from each individual system
• RT tickets for customer (student/faculty/staff) facing ticketing
• An in-house built hourly log summary email of all systems which mails out using perl. The logs are agregated to a central system running syslog-ng and sent by the systems using either syslog or rsyslog (see /etc/syslog.conf or /etc/rsyslog.conf man pages for your own system).

So I need a little something extra to assist me in picking out the information that is most important to me. There's a specific set of systems I support which I am most concerned and I filter my email to account for that. E.G. I have a "tickets important" mail folder which gets funneled using keywords for specific applications or tickets I want immediate attention. All other tickets go into a generic tickets folder for reviewing when I exhaust my "tickets important" folder to help out other admins. I do the same thing with Icinga alerts (with an "Icinga" and "Icinga Critical" folder). I check my email often but sometimes not often enough. Sure the "important" and "Critical" mail folders helped but I needed a better alerting system to warn me when I am deeply buried in a terminal and forget to check my email. I use KDE and with it KMail. KMail has notifications for new mail but it's the same notification for all new mail with no ability to specify the type of new mail. Luckily the KDE notifications can output to a log file in addition to its "New Mail" sound. This is where using the Linux kernel inotify functionality is useful.

Introducing inotify and incrond

inotify is a Linux kernel subsystem that acts to extend filesystems to notice changes to the filesystem (i.e. monitoring inodes). This is useful because we can monitor changes of the log file generated by KDE notifications and then do a little something extra.

inotify is actually an API accessed via system calls using C. So it's not a program. This is where incrond comes in handy because the author, Lukas Jelinek, wrote a cron-like daemon which can execute shell scripts when inotify events occur. Look in your vendors package system to install incrond. In KUbuntu 12.04 the package is incron.

Setting up your notification

System Settings > Common Appearance and Behavior > Application and System Notifications.

Once you're there choose the drop down box next to event source and select KMail. Once you have KMail selected choose the "New Mail Arrived" alert and add the option to "Log to a file". If you notice in the screen shot I'm choosing to log to a file at /home/sam/mail-notify.log.

screenshot

Now that I have my KMail notifications logging to a file I now want to use inotify and watch that file for changes. First let's write a script which will parse the KDE notifications log file and then chime a specific sound different from other sounds.

Now run the command "incrontab -e" and edit your incrontab to be the following.
You should start to hear notifications upon arrival of new important mail. For more information see the incrond man pages.