Rudder

The /var/log/rudder/compliance/non-compliant-reports.log file is designed as a "poor man's solution" to this. Each line represents one such change, received from one node, for one component/directive/rule. A simple script or deamon could read this file to get these events.

Yes, but it is :
- really poor
- not documented
- not obvious to use it even when we know it exists

For information, it is now documented and an example logstash config file to parse it is provided in the manual: http://www.rudder-project.org/doc-3.2/_monitoring.html#_monitor_events.