Quota Notification Through Email

In /etc/syslog.conf you set up various methods of reporting different types of system errors. You can have this particular type of error emailed. But, you will probably have to have others come with it. This particular error is considered kernel.info. If you send kernel.info to your email it will bring any info kernel messages with it. Another method is to set up a cron job that will grep the for the failure message in your normal system error log reporting file and send it to email
Ex. 0* * * * grep limit /var/adm/messages |maix -s "Limit reached" user@domain
This will do the grep every hour. You can change the frequency, but you won't ever be able to get it exactly when it happens like you would with the first approcah, unless you run this cron job about every minute, which will add a lot of load to your system.

Good luck.

Install Swatch (search of it on Google). It is an excellent log monitoring tool that uses Perl. Swatch is very easy to use and is very flexible - you will probably find all kinds of other uses for it.

Set Swatch up to watch /var/log/messages (or wherever your quota messages are set to appear). As the action, pass the log entries to a bash script.

This shell script uses awk to get the user's name from the log entry. Think of the log entries as a series of database fields seperated by spaces. Look at a quota message and determine which field contains the user's name (the first field is field 1). Then the command to use is this:

USER=$(echo $LOGENTRY | awk -F' ' '{print $n}')

where n is the field number noted above (make sure to use single quotes and not double). Then send an e-mail to $USER@yoursystem.com notifying them their quota is full.