Comment by MartijnBraam

Wouldn't this be more reliable by recording udev events instead of parsing the syslog?