Execute a command when a device is connected via USB

You could parse /var/log/messages, but I wouldn't.

I'd write a udev rule that ran a script when you connect/disconnect the device. There's some more information on it here

I've copied the salient points in case that site goes down:

Rule files are stored in the /etc/udev/rules.d/ directory.

There's some advice from the README in that directory on how to name rule files:

Files should be named xx-descriptive-name.rules, the xx should be chosen first according to the following sequence points:

< 60 most user rules; if you want to prevent an assignment being overriden by default rules, use the := operator.

these cannot access persistent information such as that from vol_id

< 70 rules that run helpers such as vol_id to populate the udev db

< 90 rules that run other programs (often using information in the udev db)

=90 rules that should run last

The first part of a udev rule is the matching keys. We will use the KERNEL entry from the very top of the chain as well as the idVendor, idProduct, and serial attributes from the device specific information. This will positively identify this particular thumb drive and ignore all others. The kernel argument uses a question mark as a wild card so that if our drive were mounted on a different node (ie: sda1, sdb1, sdc1, etc.) it could still be identified.

KERNEL=="sd?1", ATTRS{idVendor}=="13fe", ATTRS{idProduct}=="1f00",
ATTRS{serial}=="50E6920B000AE8" 

Now that we have the keys necessary to identify the particular hardware we’re looking for we can add assignment arguments. In our case we added two. The first creates a symlink to this device inside of the /dev/ directory. The second executes a script in our home directory:

SYMLINK+="hackaday", RUN+="/home/mike/notify-plugin.sh 'HackaDay Thumbdrive:' 'Connected as: $KERNEL'" 

Here is the final rule assembled into one line:

KERNEL=="sd?1", ATTRS{idVendor}=="13fe", ATTRS{idProduct}=="1f00", ATTRS{serial}=="50E6920B000AE8", SYMLINK+="hackaday", RUN+="/home/mike/notify-plugin.sh 'HackaDay Thumbdrive:' 'Connected as: $KERNEL'" 

We added this as the only line in our rule file and then restarted udev using these commands:

sudo nano /etc/udev/rules.d/81-thumbdrive.rules 
sudo /etc/init.d/udev restart

Yes, every time you plug in or disconnect and USB device, a message (or messages) is (are) written in the /var/log/messages. You can easily check those out using the command dmesg. It wouldn´t be entirely unreasonable to poll that file every (x) units of time to check for connect/disconnect messages and act accordingly.