http://sourceforge.net/projects/swatch/
With swatch you can easily monitor (growing) log files
in realtime and create email alerts based on log file content.
e.g. with a config file like this:
watchfor /Priority\: ([1|2])/
echo=normal
mail=alerts@your.domain,subject=[SNORT] Priority $1 Alert
and a swatch command like this:
swatch --daemon -c /var/ipfire/snort/swatchrc --input-record-separator='\n\n' -t /var/log/snort/alert
you can setup email alerts for SNORT alerts.
This still needs an active MTA (e.g. dma or postfix).
