Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to monitor all messages in for a string and then notify the user when this string occurs?

I have the problem that I'm getting disk I/O errors and I suspect that it's not a HDD failure, but somehow is caused by a piece of software. The only way I know that I have disk I/O errors is that I sometimes look through all the messages in the out of curiosity. Of course this does not give me real time information.
Therefore I want to receive a notification when the following message occurs in the Console:

07/01/2013 20:59:06 kernel  disk0s1: I/O error.

Is this somehow possible? It's OK if this means that Console has to be on all the time.

I'm on Snow Leopard 10.6.8.

share|improve this question
up vote 2 down vote accepted

I would not use Instead use with the following command:

tail -f /var/log/system.log | grep "string you are looking for"

then leave that window open and you will see all matching entries in that window as you work.

Also know that when the system.log file is rotated (due to size/time) tail will stop. you will need to restart the command.

share|improve this answer
Thanks, that looks like what I'm looking for. Could you clarify the rotating bit? How often is the system.log rotated? Could I code into terminal that it should restart automatically as well? – Saaru Lindestøkke Jan 7 '13 at 21:15
@BartArondson When the log gets too long, it gets archived into a file named system.log.1.bz1, for example. – Kevin Chen Jan 8 '13 at 3:05
  1. sudo /usr/bin/gem install terminal-notifier

  2. Save this script as ~/bin/logcheck and run chmod +x ~/bin/logcheck

    [ -f $tmp ] && last=$(cat $tmp) || last=""
    found=$(grep -A-1 "^$last" /var/log/system.log | grep -F 'kernel  disk0s1: I/O error')
    [ -n "$found" ] && terminal-notifier -message "$found"
    last=$(grep -Eo '^\w{3} [ \d]\d \d\d:\d\d:\d\d' /var/log/system.log | tail -n1)
    printf %s "$last" > $tmp
  3. EDITOR=nano crontab -e, add */5 * * * * ~/bin/logcheck

share|improve this answer
I get sudo: usr/bin/gem: command not found. I'm on 10.6.8, so that might matter. Sorry I forgot to mention it at first. – Saaru Lindestøkke Jan 8 '13 at 22:19
@BartArondson RubyGems has only been installed by default since 10.7. terminal-notifier doesn't work on 10.6 either, but you can use growlnotify. – user495470 Jan 9 '13 at 7:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.