You could parse /var/log/messages, but I wouldn't.
I'd write a udev rule that ran a script when you connect/disconnect the device. There's some more information on it here
I've copied the salient points in case that site goes down:
Rule files are stored in the /etc/udev/rules.d/
directory.
There's some advice from the README in that directory on how to name
rule files:
Files should be named xx-descriptive-name.rules, the xx should be
chosen first according to the following sequence points:
< 60 most user rules; if you want to prevent an assignment being
overriden by default rules, use the := operator.
these cannot access persistent information such as that from vol_id
< 70 rules that run helpers such as vol_id to populate the udev db
< 90 rules that run other programs (often using information in the
udev db)
=90 rules that should run last
The first part of a udev rule is the matching keys. We will use the
KERNEL entry from the very top of the chain as well as the idVendor,
idProduct, and serial attributes from the device specific information.
This will positively identify this particular thumb drive and ignore
all others. The kernel argument uses a question mark as a wild card
so that if our drive were mounted on a different node (ie: sda1, sdb1,
sdc1, etc.) it could still be identified.
KERNEL=="sd?1", ATTRS{idVendor}=="13fe", ATTRS{idProduct}=="1f00",
ATTRS{serial}=="50E6920B000AE8"
Now that we have the keys necessary to
identify the particular hardware we’re looking for we can add
assignment arguments. In our case we added two. The first creates a
symlink to this device inside of the /dev/ directory. The second
executes a script in our home directory:
SYMLINK+="hackaday", RUN+="/home/mike/notify-plugin.sh 'HackaDay Thumbdrive:' 'Connected as: $KERNEL'"
Here is the final rule assembled
into one line:
KERNEL=="sd?1", ATTRS{idVendor}=="13fe", ATTRS{idProduct}=="1f00", ATTRS{serial}=="50E6920B000AE8", SYMLINK+="hackaday", RUN+="/home/mike/notify-plugin.sh 'HackaDay Thumbdrive:' 'Connected as: $KERNEL'"
We added this as the only line in our rule file and then
restarted udev using these commands:
sudo nano /etc/udev/rules.d/81-thumbdrive.rules
sudo /etc/init.d/udev restart