I would consider re-using apps already available for this purpose like swatch and logwatch. Also instead of remotely log-in todo the queries I would centralize the logging to one host.

A good guide can be found at Logging with syslog-ng.

It might not be what you are looking for, just thought it might help.