I have the following line in my /etc/rsyslog.conf:programname, contains, suhosin /var/log/suhosin.logwhich logs all php security related incidents to /var/log/suhosin.log. That is nice, but I would like rsyslog to execute my script action.sh instead of logging to file. How could I do that? 
rsyslog: execute script on matching log event
rsyslog
You are looking for omprog.module(load=omprog)action(type=omprog       binary=/pathto/omprog.py --parm1=\value 1\ --parm2=\value2\       template=RSYSLOG_TraditionalFileFormat)See the docs for more details:http://www.rsyslog.com/doc/v8-stable/configuration/modules/omprog.html