Logwatch Log File Monitor is a skill that watches log files in real-time and sends alerts to a Telegram chat when specified patterns are detected. It can monitor any readable log file, including system logs such as /var/log/syslog, application logs, and web access logs.

Pattern matching is driven by user-defined regular expressions. Built-in defaults cover common cases like ERROR, WARN, and exception strings, but any custom regex can be configured. Each pattern carries a severity level — high, medium, or low — so alerts carry context about the significance of the match.

Smart position tracking means the skill only reads new lines since the last check, avoiding duplicate alerts on previously scanned content. When a match is found, the Telegram alert includes the log file path, the matched pattern name, and the full line content, giving enough context to act without opening the log manually.

Configuration is done through a config.json file that lists file paths and pattern definitions. Telegram credentials (bot token and chat ID) are supplied via a .env file. The skill requires Node.js v18 or later and a free Telegram account. There is no package registry entry; installation involves unzipping the provided archive, running npm install, and starting the watcher with node src/index.js watch.

This skill is suited to infrastructure monitoring, application error detection, and any workflow where an operator or AI agent needs immediate notification when a log line matches a critical pattern.

Use cases

Alert on application exceptions appearing in a server-side log file

Monitor /var/log/syslog for failed service starts or kernel errors

Notify a Telegram chat when an access log records HTTP 5xx errors

Track custom warning patterns in a multi-service deployment across separate log files

Route severity-differentiated alerts to Telegram by configuring high, medium, and low pattern levels

When to use it

When the target environment runs Node.js v18 or later and Telegram is an acceptable alert channel

When regex-based pattern matching against line content is sufficient for the alerting logic

When only new log lines since the last check need to be evaluated, not historical content

When alert payloads of file path, pattern name, and raw log line are enough context for the recipient

When not to use it

When the team uses a different alerting channel such as Slack, PagerDuty, or email — Telegram is the only supported destination

When log ingestion from structured logging systems or centralized log platforms is needed rather than flat file tailing

When the environment cannot run Node.js v18+

When historical log analysis or backfilling past events is required, as only new lines since the last check are processed

When no MCP tool endpoints are needed for agent orchestration — this skill exposes no discoverable tool calls

Logwatch Log File Monitor Telegram Alerts

Use cases

When to use it

When not to use it