Hi

main question
I want to start a certain script every time a certain message appears in var/log/messages . Is there a more elegant way to do this than with tail -f and grep ?
Maybe a prog that monitors the kernel messages and can start/stop other programs or scripts?

background information
I would like to do this for reconfiguring my firewall. I use CIPE to establish a VPN with a friend of mine. Since we both have dyn IPs I can only open the CIPE port for all source IPs before the connection is established (since I don´t know his IP before, because I can´t be sure that his dyndns.org account has been already updated).
I want to close this port for all source IPs except his after the connection is established (being a little paranoid ... but it would help to get rid of a lot of ugly messages too).
My idea is: when the connection is established the message "new peer" appears in /var/log/messages, when the connection goes down, I get a "peer down". These messages should trigger a script that changes my iptables rules to fit the situation. Any other suggestions are of course welcome.

THX for any tips in advance

It is much simpler (if you are not maximalist), to restrict access to that port to the dynamic IP addresses your friend used to get from his ISP.

Just grep out those IP addresses from /var/log/messages, and specify the corresponding IP address range on the firewall.

This is what I do in the same case.

THX for that suggestion! That would make it better and I will definatly use this to limit the initial hole in the firewall. But I use a quite big ISP, so I probably would have to use a quite big range (in fact there are at least 2 IP ranges) ...
Seems I am maximalist

And the possibility to start/stop programs depending on a certain kernel message could be usefull for other cases too

What if he would send you e.g. a mail with his IP address immediately before connection?
That would require a script on his side.
But then you could catch that mail with procmail on the fly.

It would be more advantageous to send that mail BEFORE the connection is made, since then you could keep that port closed for anyone, and only open it when you receive his mail with his IP address.